php sudo shell_exec command runs from command line, but not from browser

Question

I am running lighttpd with php-fpm. I have added the http user to my sudoers, as a nopasswd sudoer. I have the following script:

<?php
    echo shell_exec("sudo sh -c 'echo \"wtf3\" > /etc/openvpn/auth.txt'");
?>

It runs fine when I do:

sudo -u http php testsudo.php

but fails when run through the browser.

shell_exec("whoami");

confirms that I am user http when in browser.

What gives?

Answer 1

Would it be out of the question to make a shell script that would run your command?

#!/bin/sh
sudo whoami

in the php:

$retVal = `/path/to/custom/script/myscript.sh &2>1`;
if ($retVal) echo 'SWEET';
else echo 'POOP: ' . $retVal;

{command} inside `` means the same as shell_exec('{command}') on a linux server. If I'm not way off base here your goal is to add users to your VPN (among other things perhaps) in which case you could pass command-line parameters for username/password/etc to your custom shell script.

It's not exactly a pure shell_exec() answer to your question, but maybe you can run myscript.sh without doing sudo. Just basing this on the fact you said everything you tried worked in shell and path was set in echo $PATH , but not sudo echo $PATH in your PHP script. Seems for some reason that sudo is an issue in php, but not in shell so...let's move the sudo back to shell and try it that way.