Simple way for web to execute root shell script.

Dunno, change script ownership to root and use setuid, sudo chmod u+s. It used to work, nowadays who knows? It did used to provide security holes.

As you probably already know, the system won't run shell scripts as setuid, even if the setuid bit is set. So, the direct route is out.

My gut reaction would be to have the webserver use sudo(1) (with suitable limitations set in the /etc/sudoers file) to run the script via a system(3) call.

If you mistrust sudo(1), then you /could/ write a simple setuid wrapper program that executes the script after making some rudimentary userid checks (ruid == www, euid == root, etc. (perhaps check that session leader is apache?))

HTH

Use sudo to call the script. First, drop a file into /etc/sudoers.d/ containing something like the following (untested):

www ALL = (root) NOPASSWD: /path/to/script

That should allow Apache running as www to call 'sudo /path/script' to run 'script' as root with no password needed. But at the same time, the www user won't be able to run anything else as root (nor any other user).

On Fri, 23 May 2025 14:08:25 +0000, Lew Pitcher wrote: [snip]

Nope, not session leader. But process group leader works.

FWIW, the Linux kernel does not honour the setuid bit when running hashbang scripts.

doesnt seem to anymore

cant one execute it direct from apache? This is how I was thinking of doing it

Thats how I have done it in the past.

Useful info. Thx

That is actually perfectly fine. I like that it nails everything down to one perfectly useless script to hacker.

Now to solve the nightmare of apache site config to allow it to execute that directly...

So I discovered...and that is fair enough, as its a *bit* of security hole

If it's a shell script then it won't run as root even if it is suid root.

I'd go the sudo way, but I'm not neutral about that¹.

Greetings Marc

My "quickest and simplest solution":

$ su Password: # sed -i -e 's,^www:.*,www:x:0:0:Apache:/var/www:/usr/sbin/nologin,' /etc/passwd # apachectl restart # ^D $

YMMV.

Elijah

------ personally would run the script from cron and have Apache view results

I did in fact go that way... After stumbling through the usual mess of 'it worked perfectly well before so let's change the way we do it' crap with apache2 versus 2.4..

You've been given lots of options already. But not this one.

What "hardware stuff" is it monitoring? If it is reading files in /proc and/or /sys to obtain its "data" then another alternative would be to setup /proc and /sys to be mounted group or world readable (or to reset permissions on the necessary files via a rc.local boot script to group or world readable). That would let the script "monitor" without being root. Then you could even convert the script into a CGI script (which Apache is more than able to execute, and doing so for minimal text output involves the script outputting a handful of HTTP headers before the monitor data) and get your "monitoring data" back via Apache.

Sadly the data is not available in /sys or /proc AFAIK. I wanted information on the temperature and data volumes on the SSDs and the temperature of the ARM core. Plus data on the amount of data being transported over the ethernet interface. The tools that came to hand were vgcencmd, smartctl, df and ip. Plus some sedery grepery and awkery

The script is (if you are interested)

#!/bin/bash smartctl -a /dev/sda | grep Celsius | awk '{print $10}' smartctl -a /dev/sdb | grep Celsius | awk '{print $10}' vcgencmd measure_temp | sed -e 's/temp=//' | sed -e "s/'C//" ip -s link show dev eth0 | awk 'FNR == 4 {print $1}' ip -s link show dev eth0 | awk 'FNR == 6 {print $1}' df -h | grep /dev/sd

A typical output is

The intention is to poll that using AJAX and parse it into the position of needles on dials in a web page.

I used to do this via SNMP, but less and less is available with SNMP and its clunky as s*it,

If any of that is in /proc or /sys. I would like to hear about it.

None of this is precision stuff: I am building an ARM based NAS and I just need a quick and easy way to keep an eye on it to see if it gets to hot or too full as I develop stuff

It probably doesn't need to run as root, but rather the www (I suspect you mean www-data) user should be in the correct group to access the hardware.

I have various Pi's running Python flask http servers or use the nginx web server and uwsgi to run Python programs. They all run as the www-data user, and the have access to cameras, i2c and 1-wire temperature sensors (groups video, i2c and gpio), and also the disk group so they can write results to sqlite databases. Nothing runs as root.

---druck

You could have it running all the time and accepting requests to do things via a socket interface that you can connect to from a web-based frontend.

Alternatively, it can be running its own mini HTTP server, either directly exposed on a public port or accessed via a server-side proxy (what they insist on calling a “reverse proxy”) from Apache/Nginx.

Either way, this would likely be awkward to implement as a shell script. I would recommend using Python instead.

For better or for worse? ;)

Yeah, at least the smart data is not (as far as I am aware) available via /proc or /sys.

Another option. You could setup a cronjob, as root, to run your script on some periodic basis (once per minute, every 10 minutes, etc.) and save the results into a file that is readable via the 'www' user (or to save the info directly into a file in the Apache htdocs hierarchy from where you want to retreive it).

Then you can 'pull' the data via Apache from that file.

You'd have data that is up to date as of the last run of the script, but you would not have the "exactly now it is Y" aspect (unless your AJAX pulled just after a cronjob run *and* you were watching the 'meters' at that very moment).

You could even include a "date" as the first line, so you could see if something got hung by the time value being too far in the past.