0

I'm trying execute a python script from php function shell_exec(), but this script require root privileges.

The python code is very simple. Using libraries wifi python does a scan of all the SSID and provides in output the information on the various wireless networks to which he had a scan in JSON format. WiFi libraries are scanning using iwlist that requires root privileges. If it is performed by a user who does not have root privileges, it returns only the information referring to the wifi where you are connected.

If I plug in my code the string 

<?php
      echo 'Current script owner:'. get_current_user (); 
 ?>

I print screen "Current script owner: root", but if I try to run my code

<?php
    $ Output = shell_exec ("python /home/acme/XDOMV2/conn1.py");
    echo $ output;
 ?>

It will only return information about the network on which my debian system is connected. How to use lighttpd webserver and I have followed several guides about getting to the only result of having to re-install lighttpd. The question is, is there a way to run a python script as root from lighttpd? Where am I wrong?

Improve this question
6
  • 2
    Whatever you do, it feels wrong on so many ways. You do not want a web service to run anything as root. Especially not PHP. Even if it's python. Are you sure, there is not any other way?? Commented Apr 30, 2015 at 9:11
  • I agree with @omeinusch that this is almost certainly a bad idea. And, even if you do need it, you want to isolate the privs as much as possible, not push them up as broadly as possible. For example, an SUID program that just calls the one function that needs root privs (or even a program with a special entry in /etc/sudoers), with a normal-user Python script that drives it, run as normal by your PHP, would be a lot safer than having the server run as root so it can run your PHP as root so it can run your Python as root just to call that function. Commented Apr 30, 2015 at 9:30
  • If you really do need to do it this way, apparently lighttpd is built to prevent it by default because you almost never need to do it this way, even when you think you do, and they want you to have to go out of your way and configure and rebuild the server if you really know what you're doing. If so, then that's what you have to do. Commented Apr 30, 2015 at 9:31
  • Also, do you understand the difference between real, effective, and saved userid, which one PHP is using for get_current_user, and which one you need? Commented Apr 30, 2015 at 9:33
  • I double checked the man page to link [link]php.net/manual/en/function.get-current-user.php and actually it gives me the sole owner of the script, which in the case of my script is root, instead of performing shell_exec ('whoami') gives me back as user www-data Commented Apr 30, 2015 at 9:52

1 Answer 1

Reset to default
1

I would suggest to run the script as a user with proper privileages. This will minimize the risk for exploits on the system.

Next step would be ro run the script in a cron environment as that user (or root in the worst case scenario) and deliver the result via a database or a cached environment. You could also deliver the result via sockets or file handles.

Never enable a web environment to run scripts or well anything as root, it's dangerous and not how the software(lighttpd) were meant to operate.


If you're a brave soul:

This question belongs on UnixExchange but you can check this out:

And also check the docs for your lighttpd version, running as root is possible but not sound in any way.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.