0

I'm running Apache on a Linux server. There are a collection of shell scripts that need to get executed by a PHP script. Apache/PHP on the server is only needed for this one purpose. The shell scripts must be executed by user "X". I've set the User and Group properties in httpd.conf to be for user "X" and its group.

When I call the PHP script, I've included an echo of whoami. It shows user "X". I've also included an output to log file in the shell script that PHP executes that echos whoami and env variables. When the shell script runs, it reports that the user is "X", but the env variables output shows the user to be ROOT. How is this possible? This is ultimately a problem as the shell script won't run properly if it doesn't have access to the env variables for user "X".

[edit] Further clarification. The issue exists at the PHP script level too, so to simplify things, I can rephrase the issue that when I have Apache configured in httpd.conf to run as user "X", and if I trigger a PHP script that echos "whoami" and "env", then I see that "whoami" is user "X" but the "env" details are for user "root". the PHP script would look something like this...

<?php
echo "<br>". exec('whoami');
exec('env', $envo);
echo "<br>". print_r($envo);
?>
Glenn
  • 53
  • 5
  • How are "the env variables for user X" being set? How are you calling this script? What is the output that you get back that makes you think it's run by the root user? If `whoami` says it's not root then it's not root. – miken32 Oct 12 '18 at 18:24
  • the shell script is run by the php script using exec("script.sh"). the shell script logs the output of "whoami", which is user "X". the shell script then logs the output of "env". this reports the user and username as "root". – Glenn Oct 12 '18 at 18:28
  • Possible duplicate of [Run a shell command as another user or change Apache's user?](https://stackoverflow.com/q/5797816/608639), [Allow Apache to run a command as a different user](https://serverfault.com/q/157272), [PHP let www-data run a command as if it were a different user](https://stackoverflow.com/q/19858101), [Execute Script as another user whilst not being root](https://stackoverflow.com/q/29969560), [How to run script as another user without password?](https://stackoverflow.com/q/6905697), [Exec shell script with different user using Apache](https://stackoverflow.com/q/49180309)... – jww Oct 13 '18 at 03:18

2 Answers2

0

I never did figure out the discrepancy between output from "whoami" and "env". However, I found that I could successfully get the environment variables set properly by creating a shell script with exports for the needed variables and then calling that via "source" before calling my target shell script. For example, in PHP...

exec('source /home/X/setEnvironment.sh && /home/X/scripts/targetScript.sh');

This worked.

Glenn
  • 53
  • 5
0

whoami prints the effective user id.

When you start Apache, I guess you do it using the root user, or with some sudo rule. This is required to let Apache bind ports below 1024 (so the default 80 HTTP or 443 HTTPS qualify).

In your Apache config, you put User X (and probably Group X). This tells Apache that once the first process is started (via root), all other children processes will run under the X:X user and group.

So in your PHP code, when you run whoami it returns the effective ID of the process PHP runs in. This is X, since the process is a child of the first process.

But when you run env it runs the environment under which the child process was started. This environment was inherited from the first process, which is started by root. Hence you see the env of root.

Your fix is ok.

Nic3500
  • 8,144
  • 10
  • 29
  • 40