Allow PHP to execute linux commands

Question

I am dynamically creating files with laravel, I need to give them specific permissions by using chmod and change the user and group with chown.

I tried to enter the following lines to my /etc/sudoers by using visudo.

NOTE: Always use visudo otherwise you might corrupt the file.

www-data ALL=(ALL) NOPASSWD: chmod
www-data ALL=(ALL) NOPASSWD: chown

But I get syntax errors on these lines.

Giving a web server user permission to change file ownership and flags as root is potentially very very dangerous. An attacker in theory could, for example, make your private keys world-readable or replace your SSL certificate. I hope you're taking every possible care with this! — GordonM
– GordonM, Commented Mar 20, 2017 at 9:38
Thanks. But I don't know how a hacker could possibly do this. He would need full access to my webserver. — Black
– Black, Commented Mar 20, 2017 at 9:40
They could always take advantage of some other vulnerability. For example if you have a script for handling file uploads then they might find a way to co-opt it to upload a malicious PHP file. I know that if they manage to do that they can already potentially do some damage but there's no need making it any easier for them. — GordonM
– GordonM, Commented Mar 20, 2017 at 10:20

Black · Accepted Answer · 2017-03-20 09:21:10Z

2

You always have to use the full path to the binary:

www-data ALL=(ALL) NOPASSWD: /bin/chmod
www-data ALL=(ALL) NOPASSWD: /bin/chown

answered Mar 20, 2017 at 9:21

Black

20.9k47 gold badges188 silver badges300 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Can only accept in 2 days. I answered it by myselve in Q&A style to share the knowledge