How to execute a privileged action from a CGI script

Question

I want to restart a linux service from a shell CGI script, which obviously requires root rights. I'm kind of out of options that I know of:

Giving root access to my web server seems very dangerous
Using setuid on my CGI script doesn't work and people say it's generally a bad idea
Writing another service and communicating with it from my CGI through some kind of IPC - seems like a huge overkill

What are the best practices of doing something like that?

score 1 · Answer 1 · answered Jul 24 '19 at 02:29

1

Another option is to use a sudoer . As a best practice always provide the apache user as little rights as it needs.

Edit the sudoers file with sudo visudo and add a line

apache        ALL = NOPASSWD: /usr/sbin/service /usr/local/myapp *

answered Jul 24 '19 at 02:29

Dextro67

What is `myapp`? Is this the path to the CGI script? – torvin Jul 24 '19 at 02:47
It should be the specific command you want to provide access to. https://unix.stackexchange.com/a/246430 – Dextro67 Jul 24 '19 at 02:57

1 Answers1