setresuid operation not permitted when calling via php

Question

I've got following Problem: my Apache and PHP script are running as user www-data.

I want to call a script that can only be executed as root, so I added a new File to /etc/sudoers.d to allow this command for the www-data user:

echo390:/var/www/html# cat /etc/sudoers.d/iptables
www-data ALL= NOPASSWD: /sbin/iptables

my PHP script looks as follows:

<?php
$command = '"/usr/bin/sudo" "/sbin/iptables" -L  -v -n | grep "220.177.198.43"';
echo 'Benutzer: '.exec('whoami').'<br/>';
echo 'Command: '.$command.'<br/>';
$result = array();
exec($command,$result);
print_r($result);
?>

if I call the script from the command line via: sudo -u www-data /usr/bin/php test.php everything runs as expected, but when I call the script via Apache, I got the following error in apache2/error.log:

sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted

I've Upgraded Ubuntu from 12.02 to 14.04 The Same script had run in Ubuntu 12.02 without any problems. Can anybody help me? where is the error here?

groups for www-data:
echo390:~$ groups www-data
shows
www-data : www-data

As info:
I use the Apache-mpm-itk module sothat every apache virtual host runs under a separate user id. So how do you allow a specific Apache user to execute a specific shell script with root privileges (in php etc)?

Thanks in advance and kind regards Ravermeister

Answer 1

Fix for apache2.4 and mpm-itk
Place this in /etc/apache2/conf-enabled/security.conf

<IfModule mpm_itk_module>
    LimitUIDRange 0 6000
    LimitGIDRange 0 6000
</IfModule>

and restart apache.

This is not needed on apache2.2 but once I upgraded to apache2.4 my PHP scripts that were using shell_exec and sudo stopped working.

Answer 2

I find it rather weird to suggest to disable the mpm-itk as there might be a reason why it is actually used.

We use mpm-itk (version 2.4.7-02) with apache 2.4 and it works perfectly. The only thing to consider here are the new configuration directives

LimitUIDRange

and

LimitGIDRange

These directives define, which UIDs and GIDs mpm-itk can use (via setuid/setguid). As you obviously want it to be able to become root, your lower range must be ID 0. The following configuration will work here:

<IfModule mpm_itk_module>
    LimitUIDRange 0 6000
    LimitGIDRange 0 6000
</IfModule>

Be aware, the the upper border should include all user UID/GID combinations that you want to use within your configuration via AssignUserID.

Note that you can configure this for each virtual host you have. Note too, that you need a Linux kernel 3.5.0 or higher for this.

Answer 3

Your sudoers configuration is right, in fact when you exec:

  sudo -u www-data /usr/bin/php test.php

it work as expected.

In normal operation, your apache runs as root and use mpm-itk module. Here is the problem.

According to mpm-itk documentation:

Since mpm-itk has to be able to setuid(), it runs as root (although restricted with POSIX capabilities and seccomp v2 where possible) until the request is parsed and the vhost determined.

and:

mpm-itk is based on the traditional prefork MPM, which means it's non-threaded; .... You will also take an additional performance hit over prefork, since there's an extra fork per request.

This means that mpm-itk fork apache process and use setuid() in order to assign desired user to each virtual host.

According to setuid manual:

The setuid() function checks the effective user ID of the caller and if it is the superuser, all process-related user ID's are set to uid. After this has occurred, it is impossible for the program to regain root privileges.

This could explain already, but not convinced, I downloaded the source of mpm-itk and I notice that it change capability permit and restrict the uid range from 1 to UINT_MAX.

If a thread drops a capability from its permitted set, it can never reacquire that capability

My conclusion is that by using mpm-itk your php scripts can't gain root permission.

If you have the chance, you can check if running apache as www-data and disabling mpm-itk module your test.php works.