安全な方法でPHPを使用してシェルスクリプトを実行する

私はディストリビューターモジュールを使用してオーディオファイルを処理するためのWebインターフェース（php）の技術革新に取り組んでいます。https://github.com/deezer/spleeter）。

私のデモアプリケーションは動作しません。下記をご覧ください。有用なフィードバックを受けた後（thx @cas @marcus-müller）、私はそれで私の目標を達成できないことを知っています。

私が本当に達成したいのは、PHPで 'sleeter'コマンドを実行することです。

端末からrootとして実行

root@myServer:/var/www/html# spleeter separate -p spleeter:2stems -o output audio_example.mp3
INFO:spleeter:File output/audio_example/vocals.wav written succesfully
INFO:spleeter:File output/audio_example/accompaniment.wav written succesfully

PHPの結果はありません

exec("spleeter separate -p spleeter:2stems -o output audio_example.mp3");

テストのためにwww-dataユーザーとしてこのコマンドを実行すると、次のエラーが発生します。

root@j344977:/var/www/html# sudo -u www-data spleeter separate -p spleeter:2stems -o output audio_example.mp3

Traceback (most recent call last):
  File "/usr/local/bin/spleeter", line 8, in <module>
    sys.exit(entrypoint())
  File "/usr/local/lib/python3.6/dist-packages/spleeter/__main__.py", line 256, in entrypoint
    spleeter()
  File "/usr/local/lib/python3.6/dist-packages/typer/main.py", line 214, in __call__
    return get_command(self)(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/typer/main.py", line 497, in wrapper
    return callback(**use_params)  # type: ignore
  File "/usr/local/lib/python3.6/dist-packages/spleeter/__main__.py", line 114, in separate
    from .separator import Separator
  File "/usr/local/lib/python3.6/dist-packages/spleeter/separator.py", line 27, in <module>
    from librosa.core import istft, stft
  File "/usr/local/lib/python3.6/dist-packages/librosa/__init__.py", line 211, in <module>
    from . import core
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/__init__.py", line 5, in <module>
    from .convert import *  # pylint: disable=wildcard-import
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/convert.py", line 7, in <module>
    from . import notation
  File "/usr/local/lib/python3.6/dist-packages/librosa/core/notation.py", line 8, in <module>
    from ..util.exceptions import ParameterError
  File "/usr/local/lib/python3.6/dist-packages/librosa/util/__init__.py", line 83, in <module>
    from .utils import *  # pylint: disable=wildcard-import
  File "/usr/local/lib/python3.6/dist-packages/librosa/util/utils.py", line 1848, in <module>
    def __shear_dense(X, factor=+1, axis=-1):
  File "/usr/local/lib/python3.6/dist-packages/numba/core/decorators.py", line 214, in wrapper
    disp.enable_caching()
  File "/usr/local/lib/python3.6/dist-packages/numba/core/dispatcher.py", line 812, in enable_caching
    self._cache = FunctionCache(self.py_func)
  File "/usr/local/lib/python3.6/dist-packages/numba/core/caching.py", line 610, in __init__
    self._impl = self._impl_class(py_func)
  File "/usr/local/lib/python3.6/dist-packages/numba/core/caching.py", line 348, in __init__
    "for file %r" % (qualname, source_path))
RuntimeError: cannot cache function '__shear_dense': no locator available for file '/usr/local/lib/python3.6/dist-packages/librosa/util/utils.py'

この問題に対する簡単な解決策はありますか？

マイデモアプリケーションの設定

ルートとして次のコマンドを実行できます。

root@myServer:/var/www/html# ./spleetercommand.sh

www-dataには運がありません。

root@myServer:/var/www/html# sudo -u www-data ./spleetercommand.sh

これは私の設定です。

/var/www/html/sleetercommand.sh

#!/bin/bash

echo "--- Start spleeter ---"

/usr/local/bin/spleeter separate -p spleeter:2stems -o /var/www/html/output /var/www/html/audio_example.mp3

echo "--- End spleeter ---"

?>

/var/www/html/command.php

<?php

echo "get_current_user(): " . get_current_user();
echo "whoami: " . (exec("whoami"));
echo (exec("/var/www/html/spleetercommand.sh"));

?>

ブラウザ出力 command.php

get_current_user(): root
whoami: www-data
--- End spleeter ---

/etc/sudoers

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

/etc/sudoers.d/spleeter

www-data All=NOPASSWD: /var/www/html/spleetercommand.sh

sudoersの解析テスト

root@myServer:/etc/sudoers.d# sudo visudo -c  
/etc/sudoers: parsed OK
/etc/sudoers.d/spleeter: parsed OK

(Ubuntu 18、Apache、PHP7)