How to allow PHP exec to reload NGINX

Question

How can I allow these commands in PHP:

$output = exec('sudo nginx -t 2>&1');
$output2 = exec('sudo /usr/sbin/service nginx reload 2>&1');

I've looked into sudo visudo in the terminal , but it seems like that will give access to all sudo commands, when I only need the two above.

I guess the reload one isn't so important, as I can just run a cron job to do that.

I am using NGINX, with Ubuntu 20 + PHP 7

score 0 · Accepted Answer · answered Feb 16 '21 at 07:03

You can put the following lines in /etc/sudoers.d/nginx:

www-data ALL = (root) NOPASSWD: /usr/sbin/nginx -t
www-data ALL = (root) NOPASSWD: /usr/sbin/service nginx reload

This disables password prompt when running sudo /usr/sbin/service nginx reload or the other command when logged in as www-data.

This assumes that your PHP is running under www-data user.

1 Answers1