PHP shell_exec to run debian system service
I'm trying to control a system service with PHP's shell_exec function :
shell_exec('sudo /usr/sbin/service icecast2 stop');
But the only way I can get it to work is by allowing ALL users root access to the services in /etc/sudoers :
ALL ALL=(root) NOPASSWD: /usr/sbin/service
This is obviously a really bad idea, but it refuses to run if I try to set it to anything else as the service needs root privs eg :
%www-data ALL=(root) NOPASSWD: /usr/sbin/service
%www-data ALL=NOPASSWD: /usr/sbin/service
Also an echo of posix_getpwuid(posix_geteuid())['name']; gives me a different name that is running the process - not www-data. But neither of these work either :
%myphpuser ALL=(root) NOPASSWD: /usr/sbin/service
%myphpuser ALL=NOPASSWD: /usr/sbin/service
I also tried writing a bash script to control the service and call it from shell_exec, but that fails to run to.
Can anybody think of any other solution so I don't leave my services open like this?
For instance, just allowing access to this specific service and function instead?
debian php exec
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I'm trying to control a system service with PHP's shell_exec function :
shell_exec('sudo /usr/sbin/service icecast2 stop');
But the only way I can get it to work is by allowing ALL users root access to the services in /etc/sudoers :
ALL ALL=(root) NOPASSWD: /usr/sbin/service
This is obviously a really bad idea, but it refuses to run if I try to set it to anything else as the service needs root privs eg :
%www-data ALL=(root) NOPASSWD: /usr/sbin/service
%www-data ALL=NOPASSWD: /usr/sbin/service
Also an echo of posix_getpwuid(posix_geteuid())['name']; gives me a different name that is running the process - not www-data. But neither of these work either :
%myphpuser ALL=(root) NOPASSWD: /usr/sbin/service
%myphpuser ALL=NOPASSWD: /usr/sbin/service
I also tried writing a bash script to control the service and call it from shell_exec, but that fails to run to.
Can anybody think of any other solution so I don't leave my services open like this?
For instance, just allowing access to this specific service and function instead?
debian php exec
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I'm trying to control a system service with PHP's shell_exec function :
shell_exec('sudo /usr/sbin/service icecast2 stop');
But the only way I can get it to work is by allowing ALL users root access to the services in /etc/sudoers :
ALL ALL=(root) NOPASSWD: /usr/sbin/service
This is obviously a really bad idea, but it refuses to run if I try to set it to anything else as the service needs root privs eg :
%www-data ALL=(root) NOPASSWD: /usr/sbin/service
%www-data ALL=NOPASSWD: /usr/sbin/service
Also an echo of posix_getpwuid(posix_geteuid())['name']; gives me a different name that is running the process - not www-data. But neither of these work either :
%myphpuser ALL=(root) NOPASSWD: /usr/sbin/service
%myphpuser ALL=NOPASSWD: /usr/sbin/service
I also tried writing a bash script to control the service and call it from shell_exec, but that fails to run to.
Can anybody think of any other solution so I don't leave my services open like this?
For instance, just allowing access to this specific service and function instead?
debian php exec
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I'm trying to control a system service with PHP's shell_exec function :
shell_exec('sudo /usr/sbin/service icecast2 stop');
But the only way I can get it to work is by allowing ALL users root access to the services in /etc/sudoers :
ALL ALL=(root) NOPASSWD: /usr/sbin/service
This is obviously a really bad idea, but it refuses to run if I try to set it to anything else as the service needs root privs eg :
%www-data ALL=(root) NOPASSWD: /usr/sbin/service
%www-data ALL=NOPASSWD: /usr/sbin/service
Also an echo of posix_getpwuid(posix_geteuid())['name']; gives me a different name that is running the process - not www-data. But neither of these work either :
%myphpuser ALL=(root) NOPASSWD: /usr/sbin/service
%myphpuser ALL=NOPASSWD: /usr/sbin/service
I also tried writing a bash script to control the service and call it from shell_exec, but that fails to run to.
Can anybody think of any other solution so I don't leave my services open like this?
For instance, just allowing access to this specific service and function instead?
debian php exec
debian php exec
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 mins ago
spicespice
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 mins ago
spicespice
101
asked 4 mins ago
spicespice
101
101
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
spice is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
spice is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503468%2fphp-shell-exec-to-run-debian-system-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
spice is a new contributor. Be nice, and check out our Code of Conduct.
spice is a new contributor. Be nice, and check out our Code of Conduct.
spice is a new contributor. Be nice, and check out our Code of Conduct.
spice is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503468%2fphp-shell-exec-to-run-debian-system-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
