Re: Simple way for web to execute root shell script.

On 23/05/2025 at 21:44, The Natural Philosopher wrote:

On 23/05/2025 19:44, Rich wrote:

In comp.os.linux.misc The Natural Philosopher <tnp@invalid.invalid> wrote:

I have a shell script that monitors hardware stuff - it needs to run
as root and be called by Apache as user www.
>
  Bookworm linux on a Pi4.
>
Its all inside a domestic firewall so security is not a huge issue.
What is the quickest and simplest solution to this?

>
You've been given lots of options already.  But not this one.
>
What "hardware stuff" is it monitoring?  If it is reading files in
/proc and/or /sys to obtain its "data" then another alternative would
be to setup /proc and /sys to be mounted group or world readable (or to
reset permissions on the necessary files via a rc.local boot script to
group or world readable).  That would let the script "monitor" without
being root.  Then you could even convert the script into a CGI script
(which Apache is more than able to execute, and doing so for minimal
text output involves the script outputting a handful of HTTP headers
before the monitor data) and get your "monitoring data" back via
Apache.
>

Sadly the data is not available in /sys or /proc AFAIK.
I wanted information on the temperature and data volumes on the SSDs and the temperature of the ARM core. Plus data on the amount of data being transported over the ethernet interface.
The tools that came to hand were vgcencmd, smartctl, df and ip. Plus some sedery grepery and  awkery
   The script is (if you are interested)
 #!/bin/bash
smartctl -a /dev/sda | grep Celsius | awk '{print $10}'
smartctl -a /dev/sdb | grep Celsius | awk '{print $10}'
vcgencmd measure_temp | sed -e 's/temp=//' | sed -e "s/'C//"
ip -s link show dev eth0 | awk 'FNR == 4 {print $1}'
ip -s link show dev eth0 | awk 'FNR == 6 {print $1}'
df -h | grep /dev/sd
 A typical output is
 40
44
57.4
220513467
17430583
/dev/sda2       110G  6.1G   98G   6% /
/dev/sda1       510M   66M  445M  13% /boot/firmware
/dev/sda3       366G  126G  222G  37% /home
/dev/sdb1       219G  130G   78G  63% /backup
/dev/sdb2       1.6T  1.3T  297G  81% /home/Media
/dev/sda5       990G  559G  381G  60% /home/Media/Unedited
/dev/sda6       366G   26G  322G   8% /backup2
  The intention is to poll that using AJAX and parse it into the position of needles on dials in a web page.
 I used to do this via SNMP, but less and less is available with SNMP and its clunky as shit,
 If any of that is in /proc or /sys. I would like to hear about it.
 None of this is precision stuff: I am building an ARM based NAS and I just need a quick and easy way to keep an eye on it to see if it gets to hot or too full as I develop stuff
   

It seems to me that the only thing that needs root is smartctl, so
1) add www (www-data?) to disk group - sudo usermod -a -G disk www(-data)
2) add CAP_SYS_RAWIO to smartctl - sudo setcap 'cap_sys_rawio=ep' /usr/sbin/smartctl
Suggestion: assuming /usr/bin is in path but /usr/sbin isn't
#!/bin/bash
for i in /dev/sd?; do /usr/sbin/smartctl -a "$i" | awk '/Celsius/{print $10}'; done
vcgencmd measure_temp | sed -e "s/temp=//;s/'C//"
/usr/sbin/ip -s link show dev eth0 | awk 'FNR == 4 || FNR == 6 {print $1}'
df -h | awk '/^\/dev\// && gsub("  *"," ")'
--
Chris Elvidge, England
BEWITCHED, DOES NOT PROMOTE SATANISM