title: exec() and root user in PHP
body: <p>I'm building a control panel in PHP.
  This CP will manage Linux users, their screen sessions and files.</p>
  
  <p>I want to list all approaches and choose the most secure way which will be comfortable for user too.</p>
  
  <h1>Broad sudoers file (VERY dangerous!)</h1>
  
  <p>/etc/sudoers</p>
  
  <pre><code>wwwuser ALL = NOPASSWD: ALL
  </code></pre>
  
  <p>This allows any command to be run via www server user.
  It's security nightmare.</p>
  
  <h3>Pros</h3>
  
  <ul>
  <li>All commands are available</li>
  </ul>
  
  <h3>Cons</h3>
  
  <ul>
  <li>All commands are available</li>
  </ul>
  
  <h1>Wrapper scripts</h1>
  
  <p>/etc/sudoers</p>
  
  <pre><code>wwwuser ALL = NOPASSWD: /path/to/scripts/scripts/
  </code></pre>
  
  <p>This method uses small bash scripts with only few lines. Unfortunately those scripts must take arguments increasing attack surface.
  For example this script create new user</p>
  
  <p><code>#/bin/bash
  useradd $1 -s /bin/bash
  </code></p>
  
  <p>I can't list all allowed usernames so I must use args.</p>
  
  <h3>Pros</h3>
  
  <ul>
  <li>Only whitelisted commands are allowed if script is called with escapeshellarg()</li>
  <li>Gives elasticity for created usernames, folders etc.</li>
  </ul>
  
  <h3>Cons</h3>
  
  <ul>
  <li>Modifying arguments via enduser is imposible eg. for running java applications in screen.</li>
  </ul>
  
  <h1>Queue running as root user</h1>
  
  <p>In this method all commands that need root rights, are sent to queue.
  Queue daemon runs as root so it can create users etc.</p>
  
  <h3>Pros</h3>
  
  <ul>
  <li>Lower attack surface than allowing wwwuser to run any command</li>
  <li>Elastic arguments to run or filenames to create are no longer a problem</li>
  </ul>
  
  <h3>Cons</h3>
  
  <ul>
  <li>Security is mostly dependent on application itself</li>
  </ul>