shell_exec in PHP

Question

I have PHP code (setup.php) that execute bash-script, this is my code :

$hasil = shell_exec("./setup-srv.sh testajah mydomain.com");
echo "<pre>".$hasil."</pre>";

successfull when executed from commadline (setup-srv.sh), but failed when executed from browser (setup.php)

these 2 files at /var/www/html/

setup-srv.sh has several jobs :

• register subdomain to DNS server
• create and populate data to mysql database
• copy master folder and it's contents to new folder
• execute certbot to new subdomain

I chmod 2 files with 777, but still failed.

I need help, thank you at advance.

Answer 1

I'm assuming you're on a newer PHP than 5.3, or you have safe mode off.

This is likely to be an issue with the differences between your environment and the web server's environment.

Things to try:

Unlikely to be the problem, but .. $hasil = shell_exec("/var/www/html/setup-srv.sh testajah mydomain.com");

SU to the webserver user and try to run the script, see what happens.

Make sure SELinux isn't interfering with the webserver's ability to execute external programs.

• M. Syamsul Arifin: I use php 7.2. I change priviledge for www-data with this in visudo : www-data ALL=(ALL:ALL) NOPASSWD:/var/www/html but still failed
• Xaraxia: That's really not a good idea, because if your webserver is compromised you have given root privileges inside the /var/www/html tree (note, pretty sure you need a trailing slash on that directory to make it work as you expected). Be aware, though, that you actually need to run your shell, which is NOT going to be in /var/www/html, so this is not going to work.
• Xaraxia: What you need to do is put the sudo call inside the script instead, and specify the precise commands that require sudo in your sudoers file, and allow nothing else. DO NOT run a shell as root unless you want your server compromised.
• Xaraxia: All that said, you still need to check SELinux. It may be that external execution is not permitted at all.
• M. Syamsul Arifin: I put inside /var/www/html is just simple testing, now that script move to secure folder, and still working (I also use ssh for shell_exec to remote server and really good working)