Link to home
Start Free TrialLog in
Avatar of umbrae
umbrae

asked on

how to use posix_setuid to do commands as root

I'm trying to make a shell script in php that'll allow me to do setuid behavior to run some commands as root. before you say it, I'm aware of the security risks associated with this. Thats not what I need right now.

What I need is to figure out why this isn't allowing me to posix_setuid. What happens when I run this script as root, is that it works fine. If I run it as a non-root user though, it fails, giving the error "Operation not permitted".

I have my file permissions like so:

-rwsr-xr-x    1 root     wheel        1264 Apr  8 13:57 privsep.php

I'm running command like:

./privsep.php

and using php version 4.2.2 on SuSE Linux 8.2

Any help MUCH appreciated.



#!/usr/bin/php
<?

$argv = $_SERVER['argv'];
$argc = $_SERVER['argc'];

//
// privsep.php
//

// Don't allow this script to be run from the web
if (isset($_SERVER['REQUEST_METHOD']))
{
   print "<br>This program is not intended to be run directly from the WWW.\n";
   return 1;
}

   // Original user ID
   $original_uid = posix_getuid();

   // Set our real user ID to root
   $success = posix_setuid(0);
   if (!$success)
   {
       print "Error: Cannot setuid().\n";
       print posix_strerror(posix_get_last_error());
       return 1;
   }

  //DO SOME STUFF HERE

  // Drop the real UID back to the calling user ID
   $success = posix_setuid($original_uid);
   if (!$success)
   {
       print "Error: Cannot setuid().\n";
       return 1;
   }

   // Drop the effective UID as well
   $success = posix_seteuid($original_uid);
   if (!$success)
   {
       print "Error: Cannot seteuid().\n";
       return 1;
   }

   print "Success!\n";
   return 0;
?>
ASKER CERTIFIED SOLUTION
Avatar of minnirok
minnirok

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of minnirok
minnirok

IE, your problem lies not within PHP but with permission levels of linux :_)
Avatar of umbrae

ASKER

I was under the impression that if the file was owned by root, had the setuid bit (whichshould be set by root only ever), it was fully intended to do restricted root behavior with a normal user.

But I'll check out things further and if nobody else comes up with a better solution, I'll give you the points.
SOLUTION
Avatar of Marcus Bointon
Marcus Bointon
Flag of France image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial