Executing sudo linux commands through a JSP page.

Question

Hi,
I need to execute some superuser commands through a JSP page under Linux.
I added users apache and tomcat to the /etc/sudoers file with no password prompting.
My JSP page works fine with any usual linux command, but when I call a “sudo cmd” I have a message (when reading the ErrorStream instead of the InputStream) that “sudo can’t be executed because it needs a tty” even when I call the shell before the sudo command.
Here is a piece of my code (very basic):
String cmd="linux_cmd";
Process proc = Runtime.getRuntime().exec(cmd);
InputStream stdin = proc.getInputStream();
InputStreamReader isr = new InputStreamReader(stdin);
BufferedReader br = new BufferedReader(isr);
String line = null;
while ( (line = br.readLine()) != null)
out.println(line);
Is there any way I can make sudo calls from a JSP page ?
I know that making root calls from a web application is a bad thing, but for now security is not my concern.
Thank you for any tips.

Answer 1

JavaFan2 wrote:
In fact, I help supervising a student project who is supposed to write an admin application to offert graphical interfaces for some security and system tools under Linux (like fdisk, iptables etc) using J2EE, ... something like Webmin.
As I said, I know that is has a huge security risk but this app has the only purpose of learning J2EE, no security issues are treated.If you want to say "I will leave my office door open because there's no security risk in doing that" then that's a valid statement. But what you are trying to do here isn't the equivalent of leaving your office door open. It's the equivalent of finding a master key for all the offices in the world. And as such it is in fact a serious security risk which should not be circumvented.
And no, it's no good saying "But I'm only going to use this all-powerful master key to open my own office door". If you get the key then anybody else can get the key too.