Execute root commands via PHP

Read this whole post before trying it out, there are choices to be made.

Solution using a binary wrapper (with suid bit)

1) Create a script (preferrably .sh) that contains what you want to be ran as root.

# cat > php_shell.sh <<CONTENT  #!/bin/sh  /sbin/service sshd restartCONTENT

2) This file should be owned by root, and since it will later run with root permissions make sure that only root has permission to write to the file.

# chown root php_shell.sh# chmod u=rwx,go=xr php_shell.sh

3) To run the script as root no matter what user that executes it, we will need a binary wrapper. Create one that will execute our php_shell.sh.

# cat > wrapper.c <<CONTENT  #include <stdlib.h>  #include <sys/types.h>  #include <unistd.h>  int  main (int argc, char *argv[])  {     setuid (0);     /* WARNING: Only use an absolute path to the script to execute,      *          a malicious user might fool the binary and execute      *          arbitary commands if not.      * */     system ("/bin/sh /path/to/php_shell.sh");     return 0;   }CONTENT

4) Compile and set proper permissions, including the suid bit (saying that it should run with root privileges):

# gcc wrapper.c -o php_root# chown root php_root# chmod u=rwx,go=xr,+s php_root

php_root will now run with root permissions, and execute the commands specified in php_shell.sh.

If you don't need to the option to easily change what commands that will be executed I'd recommend you to write the commands directly in wrapper.c under step 4. Then you don't need to have a binary executing a external script executing the commands in question.

In wrapper.c, use system ("your shell command here"); to specify what commands you'd like to execute.

I would not have PHP execute any sudo commands. To me that sounds like asking for trouble. Instead I would create two separate systems.

The first system, in PHP (the web tier), would handle user requests. When a request is made that needs a sudo command I would place this request in some queue. This could be a database of some sort or middle-ware such as ZeroMQ.

The second system (the business tier) would read or receive messages from this queue and would have the ability to execute sudo commands but won't be in the scope of your web-server process.

I know this is a bit vague and it can be solved in different ways with various technologies but I think this is the best and safest way to go.

Allow the www-data user to run to run program1 and program2 with no password:

sudo visudo

Add to the contents of the sudoers file:

User_Alias WWW_USER = www-dataCmnd_Alias WWW_COMMANDS = /sbin/program1, /sbin/program2WWW_USER ALL = (ALL) NOPASSWD: WWW_COMMANDS

Save.

from https://askubuntu.com/questions/76920/call-a-shell-script-from-php-run-as-root