Getting exec to do root commands?

frigidman

Simple question, probably a nasty answer... but after searching the backlog of forum posts, this has come up A LOT, and no one... NO ONE has been able to answer it clearly, or at all actually.

Lets just work on this one single example:

exec('kill -9 34742',$result);

Does it do it? Well, yes and no. It executes the app of kill, but it does not do anything to the process of the same number.

PHP Doesn't have the privs. So, how would one go about doing the above command, within a PHP script, with the right privs?

Things Ive tried:
copied "kill" to a new "apache" user/grp only dir, with execute privs strictly for apache user/grp = No work, does the same thing.

Tried doing a popen, fputs of "su, password, command, exit" = No work, does nothing.

Read all the damned docs on the exec command, and its cohorts of shell_exec, system, and bitboy.

Any Ideas?

Anon

PHP running as an apache mod cannot su to root. If you set PHP up as a CGI wrapper, I think you can run your scripts as root. Is not secure though.

frigidman

Hmm...

So what you're saying is, "Theres no way to make PHP scripts do any sort of system level actions"?

Because apart from a kill operation, I also want to be able to reload services, or stop/start them with a php script as well.

Hrm, ah well.

Maybe I can make a cron file, runs every minute, and PHP writes to it to do something, and at the end of the cron it hits another php script that 'empties' the cron...

Backward, yes... but if PHP cant do the command directly, maybe a cron running as root can.

emcb_php

Hi,

You could fsockopen to the su command. But you shouldnt let any pages see your root password even stored in a php doc.

frigidman

Heh yeah =)

frigidman

The building a cron file that runs every now and then to do the special commands works out perfectly for the situation I needed.

I now have two cron files, one goes at every 10 minutes of 00,10,20,30,40,50.

This does a wget to a php to run the php file with args passed, that php file then analyzes some public domain readouts, determines if some action should be taken, then writes out to a second cron file.

The second always runs at 10 minutes as well, but of 01,11,21,31,41,51... a minute after. That file then executes, with a final command of doing another wget back to the php with a 'clearcron' arg. The php then empties the cron file.

Seems to work out perfectly too!

Of course, this all would have been easier had the original first run of the php would be able to do those exec commands... But I didnt like the idea of changing apache to run as root, nor changing php to run as a evil cgi module, nor have a socket open to the same machine and store the root password in it!