☰

以安全的方式使用 php 执行 shell 脚本

tag-icon • tag-icon shell php
以安全的方式使用 php 执行 shell 脚本

我正在努力实现网络界面（php）的技术突破，以使用分离模块（spleeter）处理音频文件https://github.com/deezer/spleeter）。

我的演示应用程序无法运行。见下文。经过有用的反馈（thx @cas @marcus-müller），我知道我不会用它实现我的目标。

我真正想要实现的是在php中执行`spleeter`命令

在终端上以 root 身份运行

root@myServer:/var/www/html# spleeter separate -p spleeter:2stems -o output audio_example.mp3
INFO:spleeter:File output/audio_example/vocals.wav written succesfully
INFO:spleeter:File output/audio_example/accompaniment.wav written succesfully

在 php 中没有结果

exec("spleeter separate -p spleeter:2stems -o output audio_example.mp3");

如果我以 www-data 用户身份执行此命令进行测试，则会出现以下错误：

root@j344977:/var/www/html# sudo -u www-data spleeter separate -p spleeter:2stems -o output audio_example.mp3

Traceback (most recent call last):
  File "/usr/local/bin/spleeter", line 8, in <module>
    sys.exit(entrypoint())
  File "/usr/local/lib/python3.6/dist-packages/spleeter/__main__.py", line 256, in entrypoint
    spleeter()
  File "/usr/local/lib/python3.6/dist-packages/typer/main.py", line 214, in __call__
    return get_command(self)(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/typer/main.py", line 497, in wrapper
    return callback(**use_params)  # type: ignore
  File "/usr/local/lib/python3.6/dist-packages/spleeter/__main__.py", line 114, in separate
    from .separator import Separator
  File "/usr/local/lib/python3.6/dist-packages/spleeter/separator.py", line 27, in <module>
    from librosa.core import istft, stft
  File "/usr/local/lib/python3.6/dist-packages/librosa/__init__.py", line 211, in <module>
    from . import core
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/__init__.py", line 5, in <module>
    from .convert import *  # pylint: disable=wildcard-import
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/convert.py", line 7, in <module>
    from . import notation
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/notation.py", line 8, in <module>
    from ..util.exceptions import ParameterError
  File "/usr/local/lib/python3.6/dist-packages/librosa/util/__init__.py", line 83, in <module>
    from .utils import *  # pylint: disable=wildcard-import
  File "/usr/local/lib/python3.6/dist-packages/librosa/util/utils.py", line 1848, in <module>
    def __shear_dense(X, factor=+1, axis=-1):
  File "/usr/local/lib/python3.6/dist-packages/numba/core/decorators.py", line 214, in wrapper
    disp.enable_caching()
  File "/usr/local/lib/python3.6/dist-packages/numba/core/dispatcher.py", line 812, in enable_caching
    self._cache = FunctionCache(self.py_func)
  File "/usr/local/lib/python3.6/dist-packages/numba/core/caching.py", line 610, in __init__
    self._impl = self._impl_class(py_func)
  File "/usr/local/lib/python3.6/dist-packages/numba/core/caching.py", line 348, in __init__
    "for file %r" % (qualname, source_path))
RuntimeError: cannot cache function '__shear_dense': no locator available for file '/usr/local/lib/python3.6/dist-packages/librosa/util/utils.py'

对于这个问题有一个简单的解决方案吗？

我的演示应用程序的配置

作为 root 我可以执行命令：

root@myServer:/var/www/html# ./spleetercommand.sh

由于 www-data 没有运气：

root@myServer:/var/www/html# sudo -u www-data ./spleetercommand.sh

这是我的设置：

/var/www/html/spleetercommand.sh

#!/bin/bash

echo "--- Start spleeter ---"

/usr/local/bin/spleeter separate -p spleeter:2stems -o /var/www/html/output /var/www/html/audio_example.mp3

echo "--- End spleeter ---"

?>

/var/www/html/command.php

<?php

echo "get_current_user(): " . get_current_user();
echo "whoami: " . (exec("whoami"));
echo (exec("/var/www/html/spleetercommand.sh"));

?>

浏览器输出command.php

get_current_user(): root
whoami: www-data
--- End spleeter ---

/etc/sudoers


#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

/etc/sudoers.d/spleeter

www-data All=NOPASSWD: /var/www/html/spleetercommand.sh

sudoers 解析测试

root@myServer:/etc/sudoers.d# sudo visudo -c  
/etc/sudoers: parsed OK
/etc/sudoers.d/spleeter: parsed OK

（Ubuntu 18、阿帕奇、PHP7）

答案1

ML 模型/分类器实际上没有理由需要以 root 身份运行。您需要解决该问题，而不是尝试成为 root。真的。

答案2

我宁愿放在/usr/local/bin/spleeter下面sudo

在/etc/sudoers.d/spleeter

 www-data All=NOPASSWD: /usr/local/bin/spleeter separate -p spleeter:2stems -o /var/www/html/output /var/www/html/*.mp3
  • 必须在 sudo 中使用完整的命令行。

并在 中/var/www/html/spleetercommand.sh插入sudo -u www-data

相关内容