sudo issues - not gaining proper permissions

Question

I have a bash script that will log on to remote device and copy a file. It works perfectly from the command line either if logged in as the user (support) or by running\

sudo -u support -i '/opt/IIS/getScreenShot' <parameter>

The support user has keys set up on every device so that the password is not asked on the scp command in the getScreenShot bash script.

I now need for this script to be able to be called/run by Apache. I have a PHP script that executes the following:

$output = shell_exec("sudo -u support -i '$command' $serial");

where $command is /opt/IIS/getScreenShot.

The command will start running (outputs back to the browser). Commands such as if [ ! -d /tmp/$1 ]; or mkdir -p /tmp/$1 do not seem to execute inside of the bash script if it is called through the Apache server and I am not sure why.

I would have thought the sudo command would have run it as the support user just as it did from the command line but it isn't. Ultimately I need for /opt/IIS/getScreenShot to be able to run from the command line and from the Apache call. Any suggestions?

Edit:

sudoers entry:

apache ALL=(ALL) NOPASSWD: ALL

/opt/IIS/getScreenShot will run as echo statements will show in the browser. Just certain commands in the script will not though. getScreenShot is:

set -e
#set -x
#Check runnable
if [ $# -lt 1 ] ; then #Check there is enough command line parameters.
    echo "Usage: $0 [<Serial#> | <Socket#>] "
    echo "      Example:  $0 GESC637005W1 "
    exit 1
fi

_socket=$(/opt/Allure/socketdata "$1" |awk -F '[(/: ]'+ '{print $10}')
#echo "socket $_socket"
if [ $_socket = "400" ];
then
   echo "400 Serial number not found"
   exit 400
fi
echo "Checking for dir /tmp/$1"
if [ ! -d /tmp/$1 ]; then
  echo "mkdir -p /tmp/$1"
  mkdir -p /tmp/$1;
fi
echo "test"
echo "scp -P$_socket support@localhost:/srv/samba/share/clarity-client/client-apps/digital-poster/screens/screenshot.png /tmp/$1/screenshot.png"
scp -P$_socket support@localhost:/srv/samba/share/clarity-client/client-apps/digital-poster/screens/screenshot.png /tmp/$1/screenshot.png
return=$?
if [ $return -ne 0 ];
then
   echo "401 scp1 failed $return"
   exit 401
fi
echo "test2"
scp /tmp/$1/screenshot.png support@172.24.16.37:/opt/digital_media/dm_content/screenshots/$1.png
return=$?
if [ $return -ne 0 ];
then
   echo "402 scp2 failed $return"
fi

A quick update to clarify my actual question. The script will actually run and the parameter gets passed to it correctly. The problem is that certain of the 'commands' in the script will not run correctly and it seems mostly tied to the test/creating of the directory. If the directory does not exist, the 'test' for it does not work. Separately, if I remove the test but issue the mkdir command directly (after making sure the directory is not there - or deleting it if it is), mkdir shows the error : mkdir: cannot create directory '/tmp/GESC637005UH': File exists. I have checked the directory directly and it isn't there. I have run the locate command on the system and can't find it so I am not sure why the mkdir command thinks it is there - and might also explain why the 'test' seems to 'fail' (i.e. it thinks it exists).

Answer 1

Here is an attempt to refactor your script. I have added some comments in-line but the main beef here is using a guaranteed-unique file using mktemp and cleaning it up when we are done with trap. Some other minor remarks:

• Exit codes are in the range 0-255 so I have subtracted 200 from yours.
• Diagnostic messages should be sent to standard error.
• The purpose of if and the other flow control statements of the shell is precisely to run a command and examine its result code. You should very rarely need to explicitly examine $? in a conditional (though including it in a diagnostic message, for example, is of course and obviously useful).

I have removed your comments and added some of my own which are probably not useful to keep in a production script.

#!/bin/sh

set -e

if [ $# -lt 1 ] ; then
    # >&2 sends diagnostics to standard error
    echo "Usage: $0 [<Serial#> | <Socket#>] " >&2
    echo "      Example:  $0 GESC637005W1 " >&2
    exit 1
fi

# Encapsulate error exit in a convenient function
die () {
    rc=$1
    shift
    # include $0 in all diagnostic messages
    echo "$0: $@" >&2
    exit "$rc"
}

_socket="$(/opt/Allure/socketdata "$1" |awk -F '[(/: ]'+ '{print $10}')"
[ $_socket = "400" ] || die 200 "Serial number $1 not found (socket $_socket)"

# Create a temporary file for this script
t=$(mktemp -t screenshot.XXXXXXXXXX) || exit
# Remove the temporary file on regular or error exit or signal
trap 'rm -f $t' EXIT ERROR HUP INT TERM

scp -P$_socket support@localhost:/srv/samba/share/clarity-client/client-apps/digital-poster/screens/screenshot.png "$t" ||
die 201 "401 scp1 failed $?"

scp "$t" support@172.24.16.37:/opt/digital_media/dm_content/screenshots/"$1".png ||
die 202 "402 scp2 failed $?"

The die function is explained in more detail in a separate Stack Overflow question

foo || bar is just a convenient shorthand for

if foo; then
    : nothing here
else
    bar
fi

You could almost equivalently say if ! foo; then bar; fi but that loses the failure exit code if foo doesn't run successfully. (Similarly, foo && bar is equivalent to if foo; then bar; fi)