douxian8883 2017-02-16 08:09
浏览 144

Sudo用php来改变文件所有者

I am running a php script and I want at runtime to be able to change a file owner to Linux user from www-data then after some house keeping change it back.

I am running the following command

$cmd = "sudo chown  www-data ".$path;
shell_exec($cmd);

where $path is a full path

i have added the following to my sudoers file with sudo visudo

www-data ALL=NOPASSWD: /fullpath/to/phpfile.php

but upon cheching my error logs I still get

^Msudo:: no tty present and no askpass program specified

what could be the problem guys? thanks

  • 写回答

1条回答 默认 最新

  • dongshang6790 2017-02-16 09:03
    关注

    Warning Using sudo in a php script is a terrible idea, as it has huge security implications.

    1. Clean and secure solution

    i need to change the ownership of the file so that mp4box can write files to that directory

    Let's say your directory is /srv/directory. You need to create a group that contains the www-data user and any user that will write to the directory (let's say there is only one user: tony).

    groupadd mygroup
    usermod -a -G mygroup www-data,tony
    

    then change the directory ownership and permissions accordingly.

    chown -R /srv/directory www-data:mygroup
    chmod -R /srv/directory 770
    

    but that is configuration/installation part and such command should not be run at runtime as it might require root access. It would allow any php script to do anything on the computer. this should be run when you install and configure the environement your script will run on.

    not dev-ops note :

    @my sysadmin: if you read this, please don't kill me.

    You shouldn't care about user permissions at runtime as it is sysadmin's job to make the system secure and ensure your code can run on it. Because you don't care about that, there should not be any sudo in your code. However, there is not a single sysadmin on earth that would grant root access to the www-data user (maybe there are, but they get fired quickly).

    more dev-ops note :

    If you are a kind person that don't want to be hated by his co-workers and/or user. You should :

    • document the needs of write access to directory X or Y.
    • Maybe create an install script that will do the configuration job as root just once.
    • Or maybe create a Docker container, or a virtual machine that is preconfigured to run your code.

    2. tldr; I-don't-care-about-security solution

    take a look at this unix stack exchange post

    评论

报告相同问题?

悬赏问题

  • ¥35 平滑拟合曲线该如何生成
  • ¥100 c语言,请帮蒟蒻写一个题的范例作参考
  • ¥15 名为“Product”的列已属于此 DataTable
  • ¥15 安卓adb backup备份应用数据失败
  • ¥15 eclipse运行项目时遇到的问题
  • ¥15 关于#c##的问题:最近需要用CAT工具Trados进行一些开发
  • ¥15 南大pa1 小游戏没有界面,并且报了如下错误,尝试过换显卡驱动,但是好像不行
  • ¥15 没有证书,nginx怎么反向代理到只能接受https的公网网站
  • ¥50 成都蓉城足球俱乐部小程序抢票
  • ¥15 yolov7训练自己的数据集