Tuesday, 27 August 2013

PHP securely bypass nix permissions

PHP securely bypass nix permissions

I'm writing a small utility which requires reading (usually) protected
sources such as system log files and /proc/*. The script can successfully
access these when run from SSH (because of running it as root, for
instance).
My problem is that I need to pass this info to a web server (a regular PHP
script accessed from the web). Let's see this by example:
secure.php (to be run as root user or similar and not in doc root)
<?php
echo file_get_contents('/var/log/httpd/error_log');
?>
webview.php (to be accessed as apache and seen from the web)
<?php
exec('php -f secure.php'); // run secure.php as root without giving
the current script any permissions
?>
The exec part "fails" because secure.php is in fact run as the current web
user (apache) and thus it can't read the error log.
So, the question is, how would I execute secure.php while still making the
webview.php script still safe (ie, without embedding root credentials in
the code, etc).

No comments:

Post a Comment