How to execute a privileged action from a CGI script

Question

I want to restart a linux service from a shell CGI script, which obviously requires root rights. I'm kind of out of options that I know of:

• Giving root access to my web server seems very dangerous
• Using setuid on my CGI script doesn't work and people say it's generally a bad idea
• Writing another service and communicating with it from my CGI through some kind of IPC - seems like a huge overkill

What are the best practices of doing something like that?

Answer 1

Another option is to use a sudoer . As a best practice always provide the apache user as little rights as it needs.

Edit the sudoers file with sudo visudo and add a line

apache        ALL = NOPASSWD: /usr/sbin/service /usr/local/myapp *