0

I have a PHP webpage running on the local apache installation. The page uses shell_exec to access the messages/chat.db via sqlite3.

shell_exec("sudo -u ben sqlite3 ~/Library/messages/chat.db \"SELECT ...

Before Mojave I got the response correctly, but since updating to Mojave I get:

unable to open database

When running in the Terminal directly, this same issue occurs and is solved by adding Terminal to the "Full Disk Access" pane in System Preferences.

I can't figure out what I need to add for the PHP page; I've tried everything I can find... sqlite3, apachectl, php-fpm, but nothing has worked.

What do I need to add?

FYI: ben is in the sudoers file

Ben Robinson
  • 165

3 Answers3

2

You are possibly doing it incorrectly.

First of all, sudo typically requires a password to be typed, and that won't happen via a Web app.

Second, the _www user doesn't get to use sudo. That's a big security hole. Don't even think of modifying sudoers to allow it.

What you should be doing instead is allow the _www user (the one the webserver runs as) access to the chat.db file, like this:

sudo chgrp _www ~/Library
sudo chgrp _www ~/Library/messages
sudo chgrp _www ~/Library/messages/chat.db
chmod g+rx ~/Library
chmod g+rx ~/Library/messages
chmod g+r  ~/Library/messages/chat.db
Nimesh Neema
  • 51,809
peter
  • 29
  • 1
    Changing the group ~/Library belongs to is dangerous. There might be other processes/applications which rely on this folder being in the same group the owning user is. – nohillside Nov 15 '18 at 19:16
  • +1 Good answer, although I do agree with @nohillside, there are better ways to give _www permission. You should also mention that they shouldn't even think of making the web process (apache/php) run under root.\ – user7886229 Nov 16 '18 at 02:33
  • Will this work? I'm nervous about messing with permissions which I have to unpick. I'd missed in my question that I'm running as a user in the sudoers file - that user has access to the chat file; but not (for example) via the terminal without adding Terminal to the Full Disk Access list; so surly this is not a user permission issue? BTW - This worked before the Mojave update – Ben Robinson Nov 19 '18 at 19:31
0

Don't have a non-Mojave system to verify, but with Mojave ~/Library has rather restricted access rights:

pse@Mithos:~$ ll -d . Library Library/Messages Library/Messages/chat.db
drwxr-xr-x@ 137 pse  staff      4384 Nov 11 09:11 ./
drwx------+ 139 pse  staff      4448 Oct  8 20:52 Library/
drwx------   13 pse  staff       416 Sep 27 17:47 Library/Messages/
-rw-r--r--    1 pse  staff  12169216 Nov 15 20:08 Library/Messages/chat.db

So while in theory any user can read chat.db nobody besides the current user can actually access the directory it resides in.

If you don't worry about others getting access to the file run

chmod o+x ~/Library
chmod o+x ~/Library/Messages

to allow any user to access files within Messages. They still won't be able to access other directories or list the content of Messages.

nohillside
  • 100,768
0

Not the correct answer really, but the only sensible solution I could come up with.

I've written a simple Mac App based on GCDWebServer that can serve the database content without using PHP/Apache/etc...

That App can be given Full Disk Access and everything works.

Ben Robinson
  • 165