通过PHP运行bash命令，更改目录，然后执行二进制文件

Question

So here's what I'm trying to do. I'm trying to start a binary under another user, via a PHP script. Apache has sudo access. The command works fine when ran via putty logged in as "test".

passthru('bash -c "sudo -u test cd /home/test/cs/ ; ./hlds_run"');

also might I add that

passthru('bash -c "sudo -u test ./home/test/cs/hlds_run"');

Won't work because of how the binary is written (it won't find it's resources unless you cd to the folder before, tested on terminal)

Answer 1

If everyone has access to /home/test/cs :

passthru('cd /home/test/cs && sudo -u test ./hlds_run');

If only the user test has access to the directory:

passhtru('sudo -u test sh -c "cd /home/test/cs && ./hlds_run"');

To arrive at the second invocation, you should already be familiar with system vs execve semantics (used by passthru and sudo respectively).

1. This is the tested shell string we need to run as a specific user:

   cd /home/test/cs && ./hlds_run

2. We can ensure that it always runs as a specific user with sudo , but sudo uses execve semantics. We have to convert our shell string to an execve array, and since this command A. relies on shell functionality like cd and B. does not include dynamic values, the best way to do this is to simply invoke a shell to interpret it verbatim:

   { sh , -c , cd /home/test/cs && ./hlds_run }

3. We can now apply sudo to run as our specific user:

   { sudo , -u , test , sh , -c , cd /home/test/cs && ./hlds_run }

4. passthru runs as a shell, so now we have to convert the execve array above back into a shell string, taking extreme care with quoting to ensure the shell will parse it into the exact argument list above. Fortunately this is a relatively simple case:

   sudo -u test sh -c "cd /home/test/cs && ./hlds_run"

5. We can now give it to passthru :

   passthru('sudo -u test sh -c "cd /home/test/cs && ./hlds_run"');

Answer 2

Have you try this? (make sure if you have exec right for hlds_run)

passthru('bash -c "sudo -u test && /home/test/cs/hlds_run"');