Unable to run scripts as sudo with the www-data user in Debian

Question

I am setting up a captive portal on a Raspberry Pi (latest distro CLI) where my web application will change NFTables rules based on who is logged in. I have a LEMP stack set up; with Laravel 8 as the PHP framework.

Nginx/php user is www-data, this user has a sudoers file setup with www-data ALL=(ALL) NOPASSWD:/var/www/vportal.getvs.net/app/Python/vportal.py

The following ls -al for the python script: -rwxr-xr-x 1 pi www-data 765 Dec 21 11:19 vportal.py

In the Laravel Controller code:

 $process = new Process(['python3','/var/www/vportal.getvs.net/app/Python/vportal.py']); $process->run(); // executes after the command finishes if (!$process->isSuccessful()) { throw new ProcessFailedException($process); } echo $process->getOutput(); 

The Python script:

import subprocess #import os #import pwd #print(pwd.getpwuid(os.getuid()).pw_name) subprocess.run("sudo nft add table nat", shell=True) subprocess.run("sudo nft 'add chain nat postrouting { type nat hook postrouting priority 100; }'", shell=True) subprocess.run("sudo nft add rule ip nat postrouting oifname \"wlan0\" masquerade", shell=True) subprocess.run("sudo nft add table ip filter", shell=True) subprocess.run("sudo nft 'add chain ip filter forward { type filter hook forward priority 0; policy accept; }'", shell=True) subprocess.run("sudo nft add rule ip filter forward iifname \"wlan0\" oifname \"wlx000e3b337325\" ct state related,established accept", shell=True) subprocess.run("sudo nft add rule ip filter forward iifname \"wlx000e3b337325\" oifname \"wlan0\" accept", shell=True) 

The idea is to have a route in Laravel 8 trigger the python script through the process command from Symfony on a particular route with the controller. I can run commands that don't require sudo without issues, but my scripts dont want anything to do with sudo. Is there a way to allow www-data to run a specific script "safely" with sudo privileges?

Note: this is only used on a local network and won't touch the internet. Not that it's any less of a risk that way, but I figured I would at least note this.

Answer 1

You can grant specific users the ability to run specific commands with sudo using sudoers files that you place under /etc/sudoers.d/.

The format for this that you could use is:

user host=(who to run as) [Options] Command

Note: You should do all of your editing in visudo.

So if you wanted to give the www-data the privilege to run all nft as root you could create the file /etc/sudoers.d/www-data with the following contents:

www-data ALL = (root) nft 

Since this is in a script, you probably do not want to be prompted for a password.

In this case you will want to add the NOPASSWD: option:

www-data ALL = (root) NOPASSWD: nft 

In the event that you only wanted to allow nft add you could do the following:

www-data ALL = (root) NOPASSWD: nft add* 

And in the event that you wanted to allow the www-data user to run more than just one command as root you can comma separate the commands:

www-data ALL = (root) NOPASSWD: nft, ls, cat 

This would allow www-data to sudo nft or ls or cat without a password.

Note: be careful when editing sudoers files. In the event that your syntax is incorrect any sudo command by any user will error out.

You can use visudo -c sudofile to validate the file. So for the example file I've been using visudo -c /etc/sudoers.d/www-data. If that commands outputs www-data: parsed OK then the syntax is correct.

Answer 2

You have a major security flaw in your sudoers file, that allows your web user to run any python file anywhere on the system with root privileges. Consider if that file contained a call to connect bash to a network socket:

www-data ALL=(ALL) NOPASSWD:/var/www/vportal.getvs.net/app/Python/vportal.py, /usr/bin/python3 

Remove the /usr/bin/python3 as soon as you can.

Now you've done that, let's see why the requirement is failing. You've allowed a specific script, vportal.py to run under sudo. But you don't ever call it with sudo; instead, you have several lines in the script itself that execute sudo nft […], and nft is (correctly) not permitted to be run as root by www-data.

Resolve the problem by removing the sudo commands from inside your script, and calling the script itself with sudo. Oh, and ensure that neither the script itself nor any of the parent directories are writable by the www-user account.