Q:

Enabling users to run shell commands on a server via 'su -' in PHP

I have downloaded a library from GitHub to run shell commands from within a PHP script. It works like this:
    $process = new Process("su - {$login}"); 
    $process->put($password);
    $process->put("\n");
    $process->put($command);
    $process->put("\n");
    $data = $process->get();
    $process->put("exit"); 
    $process->put("\n");

It is based on proc_open(). I use it on my localhost with my Linux login and password and everything works fine. I want to use this library on a web server. I wanna try 'www-data' as login but have no idea what to pass as www-data's password. What to use as login to allow users use this library on real web server, not localhost?
(I posted this to stackoverflow but they downvoted it adding that it is not about programming and more about server fault)

A:

First of all it is actually a bad idea to run system commands from web-server PHP script and even store your password in a php script with a plaintext. Imagine you are getting some user input to pass it to $command, now if you miss some checks there you will allow a malicious user to craft user parameters to run any arbitrary command on your system.
Next why you can't actually do this is most likely because out of 2 things:

Your www-data user most likely doesn't has any password set. This disallows logging in with su and that user.
Your www-data user shell are most likely set to something like /sbin/nologin which makes sense as this user aren't supposed to log into the system as real user.

But you actually don't need to change your user to run a system program. Besides most likely your distro has that www-data user to run web server under it (using system means) and every PHP script you run on your webserver are already running under that user privileges. Just run your command without doing su and that should work. Something like this:
$process = new Process($command); 
$data = $process->get();

If that doesn't works, refer to that library manual on how to spawn a shell without su, probably $process = new Process('/bin/bash') will work too.

