By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
438,278 Members | 1,357 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 438,278 IT Pros & Developers. It's quick & easy.

how to get a script to run as root

P: n/a

I'm writing a script that will find every newly updated file in /var/
www/vhosts/cyber.com/httpdocs/

and then cp the the files over to /var/www/vhosts/theroad.com/
httpdocs/

I used to do this by ssh to the server and typing in the copy command
manually. But my client would like to be able to control the timing
of these updates, so I'm trying to make it an easy-to-run script.

Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one
directory to the other. So I need the script to run as root. Can I use
exec() to use su to become root? Anyone have a working example of
that?


Feb 26 '08 #1
Share this Question
Share on Google+
7 Replies


P: n/a
lawrence k wrote:
I'm writing a script that will find every newly updated file in /var/
www/vhosts/cyber.com/httpdocs/

and then cp the the files over to /var/www/vhosts/theroad.com/
httpdocs/

I used to do this by ssh to the server and typing in the copy command
manually. But my client would like to be able to control the timing
of these updates, so I'm trying to make it an easy-to-run script.

Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one
directory to the other. So I need the script to run as root. Can I use
exec() to use su to become root? Anyone have a working example of
that?


Much better to set the proper permissions on the file system. Giving a
script root access is a huge security hole. Unless you are VERY
CAREFUL, some hacker could wipe out your entire server with one command.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

Feb 26 '08 #2

P: n/a
lawrence k wrote:
Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one directory
to the other. So I need the script to run as root. Can I use exec() to
use su to become root? Anyone have a working example of that?
Google: sudo

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 28 days, 5 min.]

Bottled Water
http://tobyinkster.co.uk/blog/2008/02/18/bottled-water/
Feb 26 '08 #3

P: n/a
On 26 Feb, 17:16, Jerry Stuckle <jstuck...@attglobal.netwrote:
lawrence k wrote:
I'm writing a script that will find every newly updated file in /var/
www/vhosts/cyber.com/httpdocs/
and then cp the the files over to /var/www/vhosts/theroad.com/
httpdocs/
<snip>
Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one
directory to the other. So I need the script to run as root. Can I use
exec() to use su to become root? Anyone have a working example of
that?

Much better to set the proper permissions on the file system. Giving a
script root access is a huge security hole. Unless you are VERY
CAREFUL, some hacker could wipe out your entire server with one command.
Agreed - if you can't do it as a normal user then you've got your
permissions model in the first place. Fix it.

Also - WTF are you using PHP to do this? Rsync does it without writing
any code?

C.
Feb 26 '08 #4

P: n/a
lawrence k wrote:
I'm writing a script that will find every newly updated file in /var/
www/vhosts/cyber.com/httpdocs/

and then cp the the files over to /var/www/vhosts/theroad.com/
httpdocs/

I used to do this by ssh to the server and typing in the copy command
manually. But my client would like to be able to control the timing
of these updates, so I'm trying to make it an easy-to-run script.

Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one
directory to the other. So I need the script to run as root. Can I use
exec() to use su to become root? Anyone have a working example of
that?
rsync -auv /var/www/vhosts/cyber.com/httpdocs/*
/var/www/vhosts/theroad.com/httpdocs/

Either:
1) Give write access to the user that's doing the update. Add them to
the group and allow group write on those files. Or,
2) Allow the user to run rsync as a user that does have these privileges
(but not root, unless you're sick of having clients). man sudo, man sudoers

Also, stop being root all the time or you're going to get hosed, sooner
or later. Pretty much any time you find yourself thinking "I need the
script to run as root", you're doing it wrong.

Jeremy
Feb 26 '08 #5

P: n/a
lawrence k wrote:
I'm writing a script that will find every newly updated file in /var/
www/vhosts/cyber.com/httpdocs/

and then cp the the files over to /var/www/vhosts/theroad.com/
httpdocs/

I used to do this by ssh to the server and typing in the copy command
manually. But my client would like to be able to control the timing
of these updates, so I'm trying to make it an easy-to-run script.

Only thing is, when I've done this copy in the past, I've always been
root, as no other user has the permission to copy from the one
directory to the other. So I need the script to run as root. Can I use
exec() to use su to become root? Anyone have a working example of
that?

Its been a long time since I did stuff like this..I am going to suggest
a completely different approach.

write a teeny C program that does exactly what you want and no more, and
invoke setuid() within it. I,e,. do NOT wrote a setuid version of
cp...write a setuid program that ONLY works from a specific directory to
another specific directory etc etc.

Then if it has root permissions and IIR the sticky bit set it can be
called by any user process to do its 'one and only dangerous root
permissions' job.
You can do the same with a script, but they are a lot easier to
alter..maliciously.
I prefer the 'Can't touch me. I'm written in C' sort of program..

The MOST dangerous script is the setuid script that someone has left
world writeable after a hasty edit..
However, in your case I would be somewhat tempted to make the target
directory at lest WRITEABLE by whatever process your PHP runs under, if
not readable..a simple matter of seyting up groups and permissions..and
then giving te user a web page generated via PHP to do the whole shebang
from.
>
Feb 26 '08 #6

P: n/a
The Natural Philosopher wrote:
write a teeny C program that does exactly what you want and no more, and
invoke setuid() within it.

You can do the same with a script, but they are a lot easier to
alter..maliciously.
Actually, no you can't. SetUID only works on binaries -- not scripts. Some
kind of security feature.

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 28 days, 15:27.]

Bottled Water
http://tobyinkster.co.uk/blog/2008/02/18/bottled-water/
Feb 27 '08 #7

P: n/a
Toby A Inkster wrote:
The Natural Philosopher wrote:
>write a teeny C program that does exactly what you want and no more, and
invoke setuid() within it.

You can do the same with a script, but they are a lot easier to
alter..maliciously.

Actually, no you can't. SetUID only works on binaries -- not scripts. Some
kind of security feature.
Actually, you can change it with posix_setuid(). But the PHP executable
must have the setuid bit set, which then means any script can change to
root (and do anything it wants). Definitely not good.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

Feb 27 '08 #8

This discussion thread is closed

Replies have been disabled for this discussion.