Development Guides Home >> Guide to Standardized Hooks

Guide to Standardized Hooks - Privilege Escalation

Scripted hook action code that runs as the cPanel user can escalate that user's privileges.

• Hookable events that occur in code that runs as the cPanel user can escalate privileges.
• A script must contain the hook action code in order to escalate privileges. Hook action code in Perl modules always executes as the default user for that event.

Escalate privileges

If a given Standardized Hook defines the escalateprivs descriptor as true, the system will execute the hook action code as the root user.

• Many hookable events already run as the root user and do not require the escalateprivs descriptor.
• You can set the escalateprivs descriptor through the describe() method or through the /usr/local/cpanel/bin/manage_hooks utility.

For more information about which events run as which users, read the documentation for that event's category.

Examples

In this example, the /var/cpanel/myapp/do_extra.pl script will run as the root user immediately before the system updates a user's password:

/usr/local/cpanel/bin/manage_hooks add script /var/cpanel/myapp/do_extra.pl --manual --category Passwd --event ChangePasswd --stage pre --exectype script --escalateprivs

sub describe {
    my $hooks = [
        {
            'category'      => 'Passwd',
            'event'         => 'ChangePasswd',
            'stage'         => 'pre',
            'hook'          => '/var/cpanel/myapp/do_extra.pl',
            'exectype'      => 'script',
            'escalateprivs' => 1,
        },
    ];
    return $hooks;
}