Adding elevated permissions to scripts in a directory

Question

I have a directory containing some scripts which I need to invoke from a web request. The scripts need elevated permissions to run.

My current thinking is to add the following lines to /etc/sudoers:

Cmnd_Alias WEB_COMMANDS = /path/to/scripts
www-data ALL=(ALL) NOPASSWD: WEB_COMMANDS

Is this the correct approach to this problem? Or am I causing a potential security vulnerability?

Using CentOS 7, if that makes any difference.

Answer 1

Anything is a potential security vulnerability. Two things:

First of all, are you sure it needs root? Why? Can you do that with capabilities instead? (You probably can.)

That being said, your example is almost spot-on. Add an asterisk after the path:

Cmnd_Alias WEB_COMMANDS = /path/to/scripts/*

And now it will work. But beware, if any of those scripts can be modified by an attacker, the attacker gains FULL ROOT ACCESS. They can simply exec('/bin/bash') and have a shell. Definitely go the capabilities route per script if possible, and DEFINITELY lock down the script directory either way. See this unix.se answer for info on managing capabilities with scripts.