Running Bash Script in a Browser Even with Apache Permissions Set
I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.
So, I created a bash script that runs the Docker command (runcontainer.sh):
#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject
Then I created a PHP file that runs that shell script (webscript.php):
<?php
exec('/usr/lib/cgi-bin/runcontainer.sh');
?>
I am running ubuntu 16.04 with apache2 installed.
Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.
I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.
Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.
Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.
permissions apache-httpd php docker
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
add a comment |
I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.
So, I created a bash script that runs the Docker command (runcontainer.sh):
#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject
Then I created a PHP file that runs that shell script (webscript.php):
<?php
exec('/usr/lib/cgi-bin/runcontainer.sh');
?>
I am running ubuntu 16.04 with apache2 installed.
Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.
I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.
Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.
Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.
permissions apache-httpd php docker
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
2
@Jesse_b Note that allowingwww-datato become root is generally a big security risk.
– Kusalananda
Feb 23 at 19:49
1
@Jesse_b I tried it just to see if it would work. I added%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-binto the bottom of my /etc/sudoers script and restarted the apache server withservice apache2 restart, I got the same tty error.
– JustBlossom
Feb 23 at 19:50
add a comment |
I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.
So, I created a bash script that runs the Docker command (runcontainer.sh):
#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject
Then I created a PHP file that runs that shell script (webscript.php):
<?php
exec('/usr/lib/cgi-bin/runcontainer.sh');
?>
I am running ubuntu 16.04 with apache2 installed.
Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.
I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.
Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.
Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.
permissions apache-httpd php docker
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.
So, I created a bash script that runs the Docker command (runcontainer.sh):
#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject
Then I created a PHP file that runs that shell script (webscript.php):
<?php
exec('/usr/lib/cgi-bin/runcontainer.sh');
?>
I am running ubuntu 16.04 with apache2 installed.
Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.
I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.
Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.
Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.
permissions apache-httpd php docker
permissions apache-httpd php docker
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
edited Feb 23 at 21:12
Rui F Ribeiro
41.5k1482140
41.5k1482140
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
asked Feb 23 at 19:40
JustBlossomJustBlossom
1063
1063
2
@Jesse_b Note that allowingwww-datato become root is generally a big security risk.
– Kusalananda
Feb 23 at 19:49
1
@Jesse_b I tried it just to see if it would work. I added%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-binto the bottom of my /etc/sudoers script and restarted the apache server withservice apache2 restart, I got the same tty error.
– JustBlossom
Feb 23 at 19:50
add a comment |
2
@Jesse_b Note that allowingwww-datato become root is generally a big security risk.
– Kusalananda
Feb 23 at 19:49
1
@Jesse_b I tried it just to see if it would work. I added%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-binto the bottom of my /etc/sudoers script and restarted the apache server withservice apache2 restart, I got the same tty error.
– JustBlossom
Feb 23 at 19:50
2
2
@Jesse_b Note that allowing
www-data to become root is generally a big security risk.– Kusalananda
Feb 23 at 19:49
@Jesse_b Note that allowing
www-data to become root is generally a big security risk.– Kusalananda
Feb 23 at 19:49
1
1
@Jesse_b I tried it just to see if it would work. I added
%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-bin to the bottom of my /etc/sudoers script and restarted the apache server with service apache2 restart, I got the same tty error.– JustBlossom
Feb 23 at 19:50
@Jesse_b I tried it just to see if it would work. I added
%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-bin to the bottom of my /etc/sudoers script and restarted the apache server with service apache2 restart, I got the same tty error.– JustBlossom
Feb 23 at 19:50
add a comment |
1 Answer
1
active
oldest
votes
I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.
To check if you can run command without password, login as root user and then
# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh
Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.
%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh
If above works, we can focus on next level.
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f502564%2frunning-bash-script-in-a-browser-even-with-apache-permissions-set%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.
To check if you can run command without password, login as root user and then
# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh
Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.
%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh
If above works, we can focus on next level.
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
add a comment |
I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.
To check if you can run command without password, login as root user and then
# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh
Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.
%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh
If above works, we can focus on next level.
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
add a comment |
I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.
To check if you can run command without password, login as root user and then
# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh
Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.
%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh
If above works, we can focus on next level.
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.
To check if you can run command without password, login as root user and then
# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh
Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.
%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh
If above works, we can focus on next level.
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
answered Feb 23 at 22:33
Kishan ParekhKishan Parekh
1011
1011
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f502564%2frunning-bash-script-in-a-browser-even-with-apache-permissions-set%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
@Jesse_b Note that allowing
www-datato become root is generally a big security risk.– Kusalananda
Feb 23 at 19:49
1
@Jesse_b I tried it just to see if it would work. I added
%www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-binto the bottom of my /etc/sudoers script and restarted the apache server withservice apache2 restart, I got the same tty error.– JustBlossom
Feb 23 at 19:50