Editing sudoers.d to allow www-data run a specific file

Question

I am running an Ubuntu server using Amazon AWS and I am trying to allow www-data to run a specific file that will push code to my git repository.

The file is under /var/ and I named it push.sh. I made a file under sudoers.d and added the following line using visudo:

www-data ALL=NOPASSWD: /var/push.sh

Whenever I run

sudo -u www-data sudo -l

I get the following response, "User www-data may run the following commands on (serverip): (root) NOPASSWD: /var/push.sh". However when I try to run this code

sudo -u www-data sudo sh /var/push.sh

I am being asked to enter a password for www-data.

Also when I make a php file to run the code using shell_exec

sh /var/push.sh

works fine, but

sudo sh /var/push.sh

does not. I would do it this way but the problem is I need to use sudo in order for the git to push properly.

I am probably missing something simple but I've been stuck on this for hours. Any help would be appreciated, thanks.

P.S. let me know if i need to give more information

Solution

The entry

www-data ALL=NOPASSWD: /var/push.sh

allows www-data to execute exactly the command /var/push.sh without a sudo password. It does not extend the ability to sudo sh /var/push.sh or even sh /var/push.sh

To work the way that you want, you must make /var/push.sh executable in its own right i.e.

• make sure it has the appropriate shebang at the top (presumable #!/bin/sh since you are trying to run it explicitly with sh)

• make it executable by at least www-data

Then invoke it directly as sudo -u www-data /var/push.sh

Comments

[Panther]

What are the permissions of push.sh

[CodingLogistics]

It's set at octal mode 755

[CodingLogistics]

Perfect, thanks. Got it to execute the file, just need to figure out why my git commits but won't push, but that's a whole different issue.

[CodingLogistics]

Also whenever I add that sheband to the top I get this error. "-bash: /var/push.sh: /bin/sh^M: bad interpreter: No such file or directory"

[steeldriver]

@MarkJohnson that's a classic symptom of having edited the file in a Windows (or possibly Mac) text editor - the ^M is a representation of the carriage return line-ending

[CodingLogistics]

Thanks for the help, I used dos2unix to fix it and code runs fine. I was using Atom to edit the .sh file. I also now realize that this is what caused me hours of frustations ._.