So apparently good news/bad news. Good news first: the suggestion to use sudo -u username user-accessible-path-to-php php-script
worked! The bad news, sounds like both of you feel that is not a good idea.
Since I have very limit unix experience, I have spent a couple of days trying to wrap my head around why it is a bad idea. The best I have come up with so far is: running the php script as "sudo - u user1" would elevate any inserted malicious code or mistakes I have made in the coding to root status and create a potentially explosive situation?
Let me as quickly as possible explain what I am attempting. Running WordPress sites, I wanted to make the majority of the files in the installation immutable using chattr +i, except of course for those areas that require being writable. So I am using a few lines in a bash script to get the right mix of locked files.
I have also created a php script that will run the WP auto update process that lives in the public_html folder, because thus far that's the only way I have been successful at running the php WP update process.
Creating a root based cron to run the bash and a user account cron to run the php script works, BUT requires a root cron entry to unlock, and another to relock the files and coordinating the timing between the three.
I wanted to combine all three processes into a single fully automated process via a single cron that will:
1) unlock the WP installation (via a single bash line)
2) update WP by running the php script (currently sudo based)
3) relock the WP installation (via a multi-line bash script)
Using the sudo method on step two works perfectly, all three functions happen in order and require no timing coordination and is a very fast process.
Am I just barking up the wrong tree or is there a way to safely combine these bash/php functions?
I have for what I thought were safety reasons, avoided making shell_exec available at the user account level.