Why adding a PHP script to sudoers file does not work? - php

Question

It seems adding a PHP script to sudoers file has no effect, whereas adding a bash script allows you to run it as root.
To demonstrate that, assume we have the following three scripts:
/var/www/literal.php
exec('sudo whoami', $output, $return_var);
var_dump($output, $return_var);
/var/www/indirect.php
exec('sudo /var/www/script.sh', $output, $return_var);
var_dump($output, $return_var);
/var/www/script.sh
#!/bin/bash
echo "$(whoami)"
Also assume we have the following lines in the sudoers file (added through visudo of course):
www-data ALL=NOPASSWD: /var/www/literal.php
www-data ALL=NOPASSWD: /var/www/script.sh
Browsing to http://localhost/literal.php we get:
array(0) { }
int(1)
Going to http://localhost/indirect.php however we get this:
array(1) {
[0]=> string(4) "root"
}
int(0)
Obviously, the sudoer line worked for the shell script, but did not work for the PHP script. Is this an intentional, by-design limitation, or could I have hope to get it to work? If so, where should I look for causes?

Answer 1

In sudoers file you specify precise command to be run. So /var/www/literal.php at least should have a shebang like #!/usr/bin/php and launched in shell as is by typing /var/www/literal.php then Enter in order to be run by sudo.
When you run that same script "via browser", this isn't happening. Instead the PHP-FPM process is interpreting the script (NGINX passes its filename to PHP-FPM). You may say (although this isn't exactly like this) that the real command being run is more or less /sbin/php-fpm /var/www/literal.php, which of course won't match to what you have in sudoers file.
Whatever command that you want to be run as sudo via PHP script, you need to be placing in sudoers exactly as it will be run when prefixed with sudo, e.g.
www-data ALL=NOPASSWD: /usr/bin/whoami
www-data ALL=NOPASSWD: /var/www/script.sh
Then:
exec('sudo /usr/bin/whoami', $output, $return_var);
Will run successfully when the script is accessed from the browser.
An off-topic, but you should not be running anything as webserver user. The www-data is NGINX/Apache user. The scripts should run under a dedicated "website specific" user, for security purpose. More on that here.

Answer 2

With the explanation provided by #DanilaVershinin in this answer, I thought a recursive approach might work. I tried it and it did! So here it is:
Our PHP script calls itself in CLI if it detects it is being called via the web server:
/var/www/control.php
if (PHP_SAPI !== "cli") {
exec('sudo /usr/bin/php /var/www/control.php param1 param2', $output, $return_var);
echo '<pre>';
var_dump(PHP_SAPI, $output, $return_var);
exit();
}
exec('whoami', $output, $return_var);
var_dump(PHP_SAPI, $argv, $output, $return_var);
And this is the line we need in our sudoers file:
www-data ALL=NOPASSWD: /usr/bin/php /var/www/control.php *
The output we get by going to http://localhost/control.php shows the calling user is root and we have received the parameters (the * at the end of sudoers line is to still match when we have parameters.)
The important concern with this is the security risk. I will share a version of this on Github where the security risk has been mitigated and will provide a link here.