I have a perl script that works fine with sudo and parses some logfiles at /var/log/ in Ubuntu 14. I want to show the program output on a webpage. My webpage code is very simple:

<h1>Under construction</h1>
exec ("perl /usr/local/bin/pflogsumm -d yesterday --smtpd_stats /var/log/mail/mail.log > parsed_mail_log.txt");
echo "<pre><p style='font-family:monospace;'>".nl2br(file_get_contents("parsed_mail_log.txt"))."</p></pre>";

Without sudo, www-data (I guess that is the user when running the script) does not have permissions to access /var/log/mail/mail.log and does not count what I want. It outputs stuff, but only zeroes in place of the numbers I wanted to check.

My question is: what should be the "good" way of doing this?

Putting www-data in the root group so that it can read the log does not seem right.

Maybe I could invoke a script with sudo, inside such script invoke

sudo perl /usr/local/bin/pflogsumm -d yesterday...

And add the previous script to visudo so that www-data could run it with sudo without asking for authentication. Again, it seems it is not the "good" or the "right" way of doing it...



Why not run a cron job (as root) every morning which executes

perl /usr/local/bin/pflogsumm -d yesterday --smtpd_stats /var/log/mail/mail.log > /path/to/parsed_mail_log.txt; chown www-data.www-data /path/to/parsed_mail_log.txt

(Assuming Ubuntu - use the appropriate apache owner on the chown), and then simply execute the second part in the browser

This would be much more secure (no executing scripts from the browser - less so from the command line), faster - it can preprocess the data overnight during off-peak times rather then real time and simpler.

  • Going with this, perfect for what I indend, thank you. – rmarques Nov 29 '16 at 10:06

Good start is to see who is the owner and group of the log files (ls -l /var/log/mail/mail.log). Having them public readable is usually not a good idea. Then check what groups is www-data in: groups www-data should tell you.

You can either

  • adjust the permissions on the file to be accessible by your user (probably not too clear)
  • adjust the user groups to access these files (existing group of the file)

Using passwordless sudo in scripts is not a good idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.