bartender1382 has asked for the wisdom of the Perl Monks concerning the following question:

I realize this isn’t exactly a Perl question, but I received no responses on StackOverflow here. I figure this is something a true Perl user would know, so I just have to ask it here. Sorry. It’s just I barely know linux admin stuff.

I would like to create a new user to be the user that Perl scripts are run from when accessed from web browsers.

So far I have done all my work under the same name I logon to my server as, Johnny1.

But to make it easier when using the top command, I would like a new user who's sole purpose is to be the one that is listed for all running Perl processes from the web.

So I create the user Sally1.

In /etc/apache2/envvars I have listed:

    export APACHE_RUN_USER=Sally1
    export APACHE_RUN_GROUP=www-data

[download]

And then I restarted the apache service.

However, Sally1 doesn't have permission to "write" or "create" files so my Perl scripts fail. Also, I realize that there may be future permissions which I am unaware of at the moment.

Is there a minimal command I can use, so that Sally1 is able to have all the permissions that Johnny1 has?

Replies are listed 'Best First'.
Re: I need a user just for Perl script run from web browsers
by hippo (Archbishop) on Apr 28, 2022 at 21:43 UTC
    I received no responses on StackOverflow

    You've received no responses there yet. In the meantime responses may have been provided but we will never know because you have chosen not to link to your post there. That's not useful. Please link to your post so we can see the responses if/when they arrive. Similarly amend your post there to link here.

    In /etc/apache2/nano envvars I have listed

    I've been using Apache since the last millennium and I have yet to come across a file at /etc/apache2/nano - you will need to explain what this file is for and why you have created it.

    Is there a minimal command I can use, so that Sally1 is able to have all the permissions that Johnny1 has?

    Why not give them the same UID?

    🦛

[reply]
[d/l]
      Is there a minimal command I can use, so that Sally1 is able to have all the permissions that Johnny1 has?
      Why not give them the same UID?

      Because that would create a single user with two different login names. And that's a really bad idea, because user IDs and group IDs should be unique. If two users share a UID, which entry in /etc/passwd is used to find home directory and login shell? getpwuid and the underlying getpwuid both return a SINGLE record.

      Alexander

      --
      Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
[reply]
        If two users share a UID, which entry in /etc/passwd is used to find home directory and login shell?
        Well during login, the login name is available, so this is used for the lookup in /etc/passwd to find the login environment. However, I just did the experiment for the relevant portion (the output of top and ps, and indeed, the login name is not preserved. You get the first login name which matches the numerical user id, so for the original problem I agree: That's a bad idea.
[reply]
[d/l]

        In the general case it is arguably a bad idea. However, in bartender1382's specific situation of wanting a user to own the apache processes it is fine, IMHO. Both users should never login and so should have /bin/false or similar as their login shell anyway. They can also happily share the same home dir.

        Note that bartender1382 has given no background as to why on earth they want to do this in the first place. It does seem like making work for no good reason when there is a perfectly valid single-use user already dedicated to apache in pretty much every O/S. It sounds very much like an XY problem to me.

        🦛

[reply]
[d/l]
      I put up the link in my OP, and fixed the error where I reference the enviers file.
       
      Yet I can find no reason to understand why the I can't make a user gets assigned to all Perl scripts run remotely via the web browser?
       
      Because even when I give that new user all the rights to the paths that some perl scripts write to, I still get a Permission denied error. And I have no idea why.
[reply]
        A quick way to test is to log in as the new user "sudo -u Sally1 bash" and then change to the same directory and try reading and writing the various paths that your script uses. Then, try running your script. (you can set environment variables to simulate the script being called by a web request)
[reply]
Re: I need a user just for Perl script run from web browsers
by haj (Vicar) on Apr 29, 2022 at 09:07 UTC

    I miss some information for a better guess...

    Is this shared hosting? I guess so, because usually one would not configure Apache to run scripts under a login user.

    Do you have admin rights? This is uncommon with shared hosting. If no, then it is no surprise that you can't run chmod. You also need admin rights to create a new user. This may be trivial, but changing the name in /etc/apache2/envvars does not create that user. If you do have admin rights, try hippo's suggestion to give Sally1 the same numerical user id as you have. Check out the command usermod, giving your numerical user id as --uid and don't forget to specify --non-unique.

[reply]
[d/l]
[select]
Re: I need a user just for Perl script run from web browsers
by Bod (Parson) on Apr 28, 2022 at 21:22 UTC

    I cannot answer your question...
    But, I had a quick look at my shared hosting where all user accounts and permissions are taken care of for me.

    Running top shows that my Perl scripts are running under the same account as I use to log in. This is when the scripts are called by Apache.

[reply]
[d/l]
      Yes, I know that part. But when I change the user in the /etc/apache2/envvars file to the new user, I keep getting permission failures when the perl script tries to write to specific directories.
       
      That includes me changing the owner of these directories to the new user.So I have no idea how to do this.
[reply]
Re: I need a user just for Perl script run from web browsers
by Polyglot (Chaplain) on Apr 29, 2022 at 08:21 UTC

    Your description has not given me a clear picture yet of what it is you are facing, but the following possibilities come to mind--perhaps they will have some value, if nothing more than to expand your ideas.

    You've said that Sally1 doesn't have permission to "write" or "create" files. Does "Johnny1" have these permissions? If so, it would seem that's an inequality that you need to look at right there. If Johnny1 can do something that Sally1 cannot, there must certainly be a difference between their permissions. Have you checked the privileges of these users on the linux platform itself (not mediated by apache)? For example, look into /etc/sudoers and see if any of the inclusions would apply to Johnny1 and not to Sally1.

    # User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo    ALL=(ALL:ALL) ALL

    [download]

    Is Johnny1 a member of root, admin, or sudo?

    Look at /etc/group and scan the list to see any place where Johnny1 occurs (www-data?), without also having Sally1.

    And if you do not have root privileges yourself and these files are inaccessible, you may need to look elsewhere for a solution, and/or contact your server admin for support.

    Apache can be very troublesome with minor details, in my experience.

    Blessings,

    ~Polyglot~

[reply]
[d/l]
[select]
      That's my problem, I am Johnny1, and I am then admin. An admin with very little experience in this field. Who set this server up with that name, Johnny1.
       
      So while I can create users, and make directories have passwords, etc. etc. it seems when I created Sally1, that user didn't have everything needed. Even though I made Sally1 part of www-data, added her to the sudo group, etc. etc.
       
      I even tried making all the paths that the perl scripts would write to owned by Sally1, etc. etc.
       
      And even with all that, when I set the enviers file so that Perl scripts are run by Sally1, those scripts the need to write to specific paths, fail at that line, even when Sally1 is listen as the owner.
[reply]

        I guess your lack of experience makes it difficult for you to find reasonable steps to narrow down the error. So let me take some shots into the blue...

        • The group www-data seems to point to an Debian or Ubuntu system. Correct? This matters because different systems have different configuration defaults.
        • ...those scripts the need to write to specific paths... Does it happen only for some paths? What are the permissions for these paths? Even the owner can't write files without a write permission!
        • Can the Perl scripts write to /tmp? If yes: What are the ownership and permissions of the files created by the script?
        • Can you login as Sally1 and write to said specific paths or does that fail, too? (NERDVANA suggested a similar approach)
        • Have you inspected your web server's error log? Are there warnings or errors regarding your scripts or about your configuration?
        • Do you have AppArmor or SeLinux policies in place? (Admittedly that's pretty far-fetched, but those could cause such behaviour)
[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom