Having a web script in PHP that communicate with a device. This device require root privileges. How to do this the best way security wise?There is two modes in the web app, one user and one admin. In user mode it will be solved by having a background script that runs as system and check a queue. However, in admin mode one can have a more interactive talk with the device for debugging purposes. In this mode a more direct connection would be preferable.Filesystem ext3.
R/W on device from web script
permissions;php
Don't use PHP (or at least PHP solely) for that. It is probably the most leaky and broken implementation of a web scripting language there currently is.Split the problem into three parts:front end - the PHP (Python, Ruby, Perl...) code that creates the webpage.back end - shell, Perl script, compiled binary, that accesses the device. Do not run it under root. Set up a separate account only for this task and allow it to access it as necessary. If chmod or setfacl is not enough and you are on Linux, use Linux capabilities (see the capabilities(7) man page) set with setcap or capsh.communication protocol and means used between the front and back end. Ideally it should be as restricted as possible, basically allowing the front end to query the back end. Depending on what you need to it can be as simple as sending messages of type read up to 1KB from device and write this 7812B to the device over a Unix socket or named pipe (see mkfifo).