I'm trying to exec a .sh script from PHP, however it is not executing.

I checked the error logs, and I'm getting the 'sh: Permission denied' error. I checked under which user php is being run, and it's done under the apache user.

I tried changing the .sh's ownership to the apache user, but there is no result.

I thought at first this was because the script was outside the www/ dir, however even when I put the script in the same directory, the error is still being given.

Are there any solutions to this other than adding the apache user to the SUDOers list?

The sh script runs fine if I launch it from putty using the 'php filename.php' command.

  • 3
    Is it a shell script or a PHP file? Your last paragraph isn't clear about that. Also, did you set execute permissions (x) on the file? Did you specify the script interpreter in a shebang line?
    – Daniel Beck
    Jul 31, 2012 at 18:14
  • It's a bash script to be ran from PHP. Yes I did make it an executable and I did specify the script interpreter. It works correctly when I execute the PHP script from putty and the bash script gets called and runs correctly. But if I run the php script from the webbrowser instead it fails to run the bash script and it will do this error since it's running as the apache user and not the user I use in putty. Jul 31, 2012 at 19:54
  • 1
    Try chmod 775 yourscript.sh . That will give r-x (read and execute) permissions to "Other" users on that file.
    – Rhyuk
    Jul 31, 2012 at 20:00
  • I tried it. No luck.. I can't know the exact reason until tomorrow though. I don't have access to the logs from my location. I will get back to you guys. Thank you for your help. :) Jul 31, 2012 at 20:19

5 Answers 5


Try the following suggestions:

  • Try to run below test command, and check whether it worked:
    • php -r "echo exec('whoami');"
  • Make sure that all parent directories and the files have at least r-x flag permissions:
    • chmod 755 dir; chmod 755 file
  • Make sure that the owner of the file is your Apache user.
    • Try also to add a +s flag (sudo) to the file (not recommended):
      • chmod u+s file,
  • Make sure that your PHP is not running in a safe_mode.
  • Make sure that the script is inside your Apache root:
    • Otherwise, move the script inside it,
    • or add that directory to your Apache configuration,
    • or add this directory to your include_path, e.g.:
      • php.ini file: include_path ".:/usr/local/lib/php:/your/dir"
      • or .htaccess file: php_value include_path ".:/usr/local/lib/php:/your/dir"
  • Check whether your shell is set to valid (e.g. /bin/sh) to your Apache user (e.g. check with: finger).
  • Make sure that your php.ini doesn't use: disable_functions for exec function
  • If using SELinux or having selinux-utils installed (a Security-enhanced Linux system), check getenforce/setenforce configuration as described in @Tonin answer.


  • If you changed your php.ini or httpd.conf file, don't forget to restart the web server,
  • Check your Apache error log for additional details.
  • Enable in your php.ini all kind of errors (display_error, error_reporting, etc.).
  • 1
    That was my problem.. the parent directory didn't have execution rights... it works now! Thank you! :) Aug 1, 2012 at 7:11
  • Still no luck for me :( Any suggestions?``` [root@kiwi tmp]# ls -ld /;ls -ld /tmp;ls -ld /tmp/sleep;grep '^include_path =\|^safe_mode =' /etc/php.ini dr-xr-xr-x. 27 root root 4096 Sep 3 12:31 / drwxrwxrwt. 4 root root 4096 Sep 3 15:45 /tmp -rwxr-xr-x. 1 root root 24 Sep 3 15:39 /tmp/sleep safe_mode = Off include_path = "/tmp:/home/kiwi_build"```
    – pihentagy
    Sep 3, 2015 at 13:44
  • 1
    Argh, setenforce solved it. OMG
    – pihentagy
    Sep 3, 2015 at 14:10

Such an issue might depend on the OS you use and how it is configured. Some linux distros (mainly those based on RHEL like CentOS or Fedora) come with SELinux activated by default. This can be checked, and temporarily changed, with the following commands:

root@ls:~# /usr/sbin/getenforce 
root@ls:~# /usr/sbin/setenforce Permissive
root@ls:~# /usr/sbin/getenforce 

You can also have a more complete view on the current configuration with:

root@ls:~# /usr/sbin/sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

This change can be made permanent by editing the /etc/selinux/config file and set the SELINUX variable to permissive or disabled.

But, the correct way to solve this kind of issue, if you are indeed in this situation, is to check the /var/log/audit/audit.log log file. It will contain all the events related to SELinux rules. You'll then probably should give your script the correct context, i.e. being authorized to be run by the apache/php user. Checking SELinux security context is done with ls -Z:

root@ls:~# ls -alZ /var/www/cgi-bin/
drwxr-xr-x  root root system_u:object_r:httpd_sys_script_exec_t .
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t ..

This list the User, the Role and the Type of each file/directory. Here the httpd_sys_script_exec_t type gives the files in the cgi directory the permission to be executed by httpd. Your shell script should probably have the same type.

You can also feed the audit.log lines to the audit2allow command. It will output you the changes needed to make SELinux happy. But usually the changes suggested need to be done on the SELinux policy itself which is not what you should do in your case (still, this output can give some clue at what is going on).

The following page describe a similar issue and different ways to solve it: http://sheltren.com/stop-disabling-selinux

  • Thank you for the detailed reply! Alas, like I mentioned I can't have root access until tomorrow. So I will get back to you too! :) And yes, I am using CentOS. Jul 31, 2012 at 20:33
  • I loved your answer, very informative! Unfortunately I didn't pick yours because the enforce was disabled and wasn't the problem. Though I did learn a lot from your answer, so thank you. I will vote you up when I get enough reputation :) Aug 1, 2012 at 7:13
  • No worries, glad to know you learned from my post!
    – Lætitia
    Aug 1, 2012 at 12:30
  • If getenforced is the problem, then it is really not obvious what the heck is going on. It saved my day!
    – pihentagy
    Sep 3, 2015 at 14:11

So I got here after searching for a similar issue on Google. I thought to drop that the comment about SELinux pointed me in the right direction.

In my own case, I was using a custom Git deploy script that uses a shell command. The command works fine on BASH but then has "permission denied" and "not a repository" on Git. This was really strange and I went through multiple fixes until I stumbled on this answer.

root@ls:~# /usr/sbin/setenforce Permissive solved the problem for me.


My situation is slightly different, but Google brought me here, so I thought I'd share...

My server is running debian stable and trying to execute a shell script worked once then the permissions automagically changed to 644 and the next attempt to run the script got Permission denied. It turned out to be a samba server issue for me and I didn't notice the pattern until now.

The QA Strange permission changes when saving file on a Samba partition from a Windows editor was the fix. I did not know about the map archive = no option even after using samba shares for a decade.

Something about using Notepad++ on a Windows desktop would change the target files' permissions to 675 instead of 775 as the umask is set up for.


Running root commands in PHP via Apache

I have a web application that needs to perform shells commands as root within a PHP function, and you would think that would be pretty straight forward… but it did take my a few googles to get all the details, so here are my handy notes on it. This is on a Linux system running Apache, and we’ll be using “sudo” within “shell_exec” to run the commands.

The main thing is to edit the /etc/sudoers file, and typically you can (as root) use the ”visudo” command to do so.

Make sure apache can run commands, AND not require a password:

apache  ALL=(ALL)       NOPASSWD: ALL

Then you need to comment out this line:

#Defaults    requiretty

If you don’t, then you will see these errors in /var/log/secure: “sorry, you must have a tty to run sudo”. Now you are ready to go, and the PHP code is simple:

$results = shell_exec(‘sudo date’);

  • 5
    This is a terrible idea. If your apache install gets compromised or the application you're running does... your hacker gets full access to the system much too easily. The right thing is to change permissions on the script, not leave things wide open
    – Journeyman Geek
    Feb 15, 2017 at 11:40
  • 2
    I feel obligated to issue a downvote on this answer due to the obvious security concerns with give apache user/role all permissions.
    – Ramhound
    Feb 15, 2017 at 12:03
  • @JourneymanGeek It's not "if", it's when the install gets compromised. Feb 16, 2017 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.