允许 PHP 更改文件和目录的所有权和权限
我想构建一个简单的网络应用程序，它管理服务器上的一些目录。 我想让人们选择使用 chown 和 chmod。
授予 PHP 此权限最安全的方法是什么？ 最快的方法就是以 root 身份运行 Apache 和 PHP，但这似乎不是一个聪明的主意。
我想到的另一件事是创建一个具有 setuid root 的单独脚本..
谢谢！
I'd like to build a simple web app, which manages some directory on a server. I want to give people the option to use chown and chmod.
What is the safest way to give PHP this permission? The quickest thing is just running Apache and PHP as root, but that doesn't seem to be a smart idea.
One other thing I thought of, was creating a separate script which has setuid root..
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
嗯，这听起来确实是一个危险的想法，我更愿意坐下来思考要实现的目标的整个策略。
当然，危险在于远程用户可以修改或上传的可执行脚本的权限升级。 Web 应用程序中的完整 chown/chmod 相当于将 root 密码粘贴到页面上。
究竟需要发生什么？
如果出于某种原因需要进行 chown 但不需要 root（我们希望），那么应该包装该功能。 我会接受用户请求并将它们排队，然后有一个单独的进程（可以是 shell、php、perl 等）通过 cron 以 root 身份运行检查此队列，检查请求是否符合允许的参数，然后进行更改。
Well, it certainly sounds like a dangerous idea to begin with and I'd prefer sitting down and thinking through the whole strategy of what is trying to be achieved.
The danger is privilege escalation of an executable script which a remote user could modify or upload, of course. Full chown/chmod in a web app is equivalent to just pasting your root password on the page.
What is it exactly which needs to happen?
If the chown needs to happen for some reason but not to root (we hope) then the functionality should be wrapped. I would take the user requests and queue them, then have a separate process (could be shell, php, perl, anything) running as root by cron check this queue, check to see if the request fit the allowed parameters, and make the changes.
一种方法是在您的计算机上设置 sudo（假设它是 Linux 机器）。 Sudo 允许您运行提升的命令，并受 sudoers.conf 文件中规定的限制约束。 使用严格的规则将其使用限制为运行 Web 服务的用户的特定目录中所需的命令（例如 www-data），然后从 PHP 脚本中调用命令 shell，如下所示
： sudo 配置非常严格，以确保突破几乎是不可能的。
One way would be to set up sudo on your machine (assuming it's a Linux box). Sudo allows you to run commands elevated, governed by restrictions set forth in the sudoers.conf file. Use tight rules to limit its use to the required commands in a specific directory for the user your web service is running under (like www-data), and then call the command shell from your PHP script something like tis:
Do make sure that your sudo config is tight, to ensure that breaking out will be next to impossible.
也许你应该看看 php 命令：chmod、chown、chgrp 和 fileperms
chmod
Perhaps you should look at the php commands: chmod, chown, chgrp and fileperms
chmod