make it possible to run occ as root #33545
Conversation
occ
Outdated
| if (posix_getuid() == 0){ | ||
| $command = implode (' ', $argv); | ||
| echo(shell_exec('sudo -u www-data '.$command)); |
There was a problem hiding this comment.
| if (posix_getuid() == 0){ | |
| $command = implode (' ', $argv); | |
| echo(shell_exec('sudo -u www-data '.$command)); | |
| if (posix_getuid() === 0) { | |
| $command = implode (' ', $argv); | |
| echo shell_exec('sudo -u www-data ' . $command); |
return code is being killed
There was a problem hiding this comment.
occ
Outdated
| if (posix_getuid() == 0){ | ||
| $command = implode (' ', $argv); | ||
| echo(shell_exec('sudo -u www-data '.$command)); |
There was a problem hiding this comment.
occ
Outdated
| // make it possible to run as root | ||
| if (posix_getuid() == 0){ | ||
| $command = implode (' ', $argv); | ||
| echo(shell_exec('sudo -u www-data '.$command)); |
There was a problem hiding this comment.
www-data might not be the default user name for the HTTP server though, mostly only Debian-based systems use that. RedHat-based systems or ArchLinux use an user named http by default.
Also, does this forwards environment variables?
There was a problem hiding this comment.
what we do in other places is read the user name from the config file, basically the owner of "config/config.php" and use that to check if the correct user is being used
There was a problem hiding this comment.
This makes sense unless config_is_read_only is used, then the config file owner could be something irrelevant such as root, as long as the http server user has read access.
There was a problem hiding this comment.
Well in worst case you can not use the root shortcut then and need to manually sudo -u yourwebserver-user occ ?
|
@karlitschek I believe we can close this PR since it was originally planned/needed as a pre-requisite for Nc Guard, right? |
make it possible to run as root Signed-off-by: Frank Karlitschek <karlitschek@users.noreply.github.com>
AndyScherzinger
force-pushed
the
occ-as-root
branch
from
5ec47c7 to
ab8c6f1
Compare
skjnldsv
added
2. developing
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
|
Finding the right user is doable from config.php ownership guessing. The tricky part is STDIN/STDOUT/STDERR handling. Neither with shell_exec nor proc_open I was able to connect the parent process pipes with the child process. shell_exec makes the parent block when occ asks for input (e.g. when you make a typo or when it needs confirmation). I've pushed some fixes that make this work on a non-Debian system too. |
make it possible to run as root
To do