SliTaz Forum

allen

Member

Registered: 2014-06-22

Posts: 36

SliTaz 4.0-base: Busybox httpd command execution

Readers Digest version: My particular application for SliTaz requires the ability to remotely change the left channel volume of alsamixer's headphone output. I liked the file system meter displayed in Tazpanel so studied the script toward modifying it to fit my needs at changing the balance of the headphone output with amixer. I wrote the following script which works fine when logged in as root from the web page (using Tazpanel httpd server), but when using busybox httpd server where only the web user is logged in: amixer fails to run. Strangely enough all Busybox commands do run (df, blkid). Either the web user needs to be added to a group or amixer doesn't have execution permissions like Busybox commands do. Appreciate your help. Thank you!

I have attached what the page loads as root (via Tazpanel httpd) and as web user (Busybox httpd). Here's the script...

'cat << EOT'

'<table class="rmp">'

'EOT'

'rmp_thead'

'echo '<tbody>''

'amixer sget Headphone | grep "dB" | while read zn lfrt io id lvl db stat'

'do'

'lfrt="$(echo $lfrt | tr -d "'

'tot="$(echo $lvl | tr -d [])"'

'lvl="$(echo $lvl | tr -d [%])"'

'stat="$(echo $stat | tr -d [] | tr '[:lower:]' '[:upper:]')"'

'cat << EOT'

'<tr>'

'<td>$zn $lfrt</td>'

'<td>$io $stat</td>'

'<td>Alsamixer Panel</td>'

'<td class="meter"><meter min="0" max="100" value="$(echo $lvl)"'

'low="$DU_WARN" high="$DU_CRIT" optimum="10"></meter>'

'<span>$tot $db </span>'

'</td>'

'</tr>'

'EOT'

'done'

'cat << EOT'

'</tbody>'

'</table>'

'EOT'

[attachment=31843,1595] [attachment=31843,1596]

allen

Member

Registered: 2014-06-22

Posts: 36

Re: SliTaz 4.0-base: Busybox httpd command execution

Sorry, edited and reposted the code since in my haste to post this morning I didn't add code from the correct file and add backticks correctly...

[c]cat << EOT[/c]

[c]<h4>$(gettext 'Alsamixer Headphone output volume')</h4>[/c]

[c]EOT[/c]

[c]cat << EOT[/c]

[c]<table class="rmp">[/c]

[c]EOT[/c]

[c]alsa_thead[/c]

[c]echo '<tbody>'[/c]

[c]amixer sget Headphone | grep "dB" | while read zn lfrt io id lvl db stat[/c]

[c]do[/c]

[c]lfrt="$(echo $lfrt | tr -d "[/c]

[c]tot="$(echo $lvl | tr -d [])"[/c]

[c]lvl="$(echo $lvl | tr -d [%])"[/c]

[c]stat="$(echo $stat | tr -d [] | tr '[:lower:]' '[:upper:]')"[/c]

[c]cat << EOT[/c]

[c]<tr>[/c]

[c]<td><img src="$IMAGES/audio.png" />$zn $lfrt</td>[/c]

[c]<td>$io $stat</td>[/c]

[c]<td><a href="$(echo $ip/setvol.cgi?$lfrt'dn')">Decrease</a></td>[/c]

[c]<td><a href="$(echo $ip/setvol.cgi?$lfrt'up')">Increase</a></td>[/c]

[c]<td class="meter"><meter min="0" max="100" value="$(echo $lvl)"[/c]

[c]low="$DU_WARN" high="$DU_CRIT" optimum="10"></meter>[/c]

[c]<span>$tot $db <img src="$IMAGES/$lfrt+lock.png" height="16" width="16" /></span>[/c]

[c]</td>[/c]

[c]</tr>[/c]

[c]EOT[/c]

[c]done[/c]

[c]cat << EOT[/c]

[c]</tbody>[/c]

[c]</table>[/c]

[c]EOT[/c]

allen

Member

Registered: 2014-06-22

Posts: 36

Re: SliTaz 4.0-base: Busybox httpd command execution

Acceptable solution.. at least in my case since security is not a concern...

edit /etc/rcS.conf removing httpd from RUN_DAEMONS

edit /etc/init.d/local.sh adding the line: httpd -u root

I didn't like the fact it was required to login as root every time it was required to change the level of the left channel alsamixer headphone and I never like saving usernames/passwords via the browser. This solution allows Busybox httpd to execute commands outside those of Busybox binary (as mentioned Busybox commands will execute).

I do welcome those that can contribute how to make the Busybox httpd user "www" execute commands other than those included in Busybox.

Thank you!

KevinG

Member

Registered: 2014-07-04

Posts: 11

Re: SliTaz 4.0-base: Busybox httpd command execution

I had issues running alsactl nrestore in a script, as that needed more permissions than the script had.

I ended up copying the asound.state file somewhere else and running:

alsactl -f /mynewlocation/asound.state nrestore

I'm note sure if this will help with your problem ...

Good luck