how restart or reload nginx using php

问题:

i change nginx conf file with php next i want restart nginx. but can not restart nginx

<?php
    if(exec("service nginx restart")) {
        echo "ok shd";
    } else {
        echo "error";
    }
?>
<hr>
<?php
    if(exec("/etc/init.d/nginx reload")) {
        echo "ok shd";
    } else {
        echo "error";
    }
?>
<hr>
<?php
    if(exec("/usr/sbin/nginx -s reload")) {
        echo "ok shd";
    } else {
        echo "error";
    }
?>

output is :

error<hr>
error<hr>
error

To do exec("service nginx restart") I need acces to php-fpm as root, so i go to /usr/local/etc/php-fpm.conf

user = nobody
group = nobody

and change it to:

user = root
group = root

and next enter service php-fpm restart

output:

Starting php-fpm [11-Feb-2016 05:14:33] ERROR: [pool www] please specify user and group other than root
[11-Feb-2016 05:14:33] ERROR: FPM initialization failed
 failed

and this means it can't be run as root.

So how can I restart or reload nginx using php?

回答1:

I need acces to php-fpm as root

OMG NO

Theres's a very good reason PHP-FPM won't run as root - because its a really, really bad thing to do.

If you really must expose this functionality via a webserver then do it via sudo. Similarly any changes to your system config should be via sudo.

BTW: one crucially important thing missing from your script is ignore_user_abort(). When (if) nginx is restarted by PHP the connection to the browser will be lost. By default, PHP will terminate at this point.

回答2:

Most people will tell you to never run php as root, however, it's fairly safe to do if you have multiple php-fpm.sock files, and you have multiple levels of security to ensure than only you are able to execute php with root permissions. Remember, php should only execute with the minimum permissions required.

NB

I am using Centos, so some of the file names, paths, and commands I use may be slightly different for you.

Security

1. Create a separate login portal that only you have access to. You could do this by opening up a port and using your firewall and / or nginx rules to allow only your IP address (ideally a dedicated IP address that you can VPN into). I would also recommend setting up google authenticator for your secure portal.
2. In your nginx configuration, you are now able to define 2 different sock files under separate server configurations.
3. Create a copy of php-fpm.conf. The file should be included in /etc/php-fpm.conf.
4. Restart php-fpm, then view its status to make sure it's working correctly. You may need to manually change the permission and group of /var/run/php-fpm/ and it's contents if you get permission errors with nginx.

Make php run as root

1. Change user and group to root (like you already have done).
2. Open php-fpm.service. I typed nano /lib/systemd/system/php-fpm.service via ssh console.
3. Change ExecStart=/usr/sbin/php-fpm --nodaemonize to ExecStart=/usr/sbin/php-fpm --nodaemonize -R. The -R allows php-fpm to run as root.
4. Restart daemon. If you are using centos, type systemctl daemon-reload.

Edit

If the only reason you want to make php execute as root is to restart nginx, then you are probably better off doing it by setting up a cron job. See: this question or manually via ssh.