I asked [this question](https://stackoverflow.com/questions/5697302/php-shell-exec-touch-redirect-and-adduser) about six months ago and I thought I might get better responses here.

I have a website written almost exclusively in javascript (HTML canvas), and a MySQL database managed via PHP. Serverside, scripts I execute are axecuted as user `www-data`. Now suppose I want to create a new linux account as well as adding the user's name/password to the database. How would I automate this? 

The actual functionality I would like extends to also creating groups for the user, creating a skeleton directory for the home folder, and having read/write access to their home folder and sub folders. In essence, I need to execute certain commands as root but I obviously can not type them in from a keyboard.

One idea I had was to set up a `/home/www-data/.ssh/` folder with keyless ssh login to root, but I am worried that is giving too much power. 

---

[Mad Hatter](https://serverfault.com/users/55514/madhatter) pointed out that this is a potential duplicate of [this question](https://serverfault.com/questions/319737/how-do-i-perform-root-actions-from-non-root-account) so I am refining my original question.

In my website each user is allowed to create their own scripts and execute them. There is a complex library created, which can dynamically load javascript scripts, execute them, almost always redrawing the HTML Canvas element. In addition to this, they can create PHP scripts.

Because the user can create their own PHP scripts, I can't just hand over root access for creating new users to www-data (by editing the `/etc/sudoers` file). What I want is a way to execute the below command/PHP script when the user is registering (therefore connecting as user `www-data`)

```
shell_exec("sudo useradd J.C.Denton");

```

But avoid the situation where, afterwards, a user writes a PHP script to use the above PHP file to start creating their own users.

My ideal scenario would be to be able to log in a user not only as a PHP session and give him access to only elements of the SQL database he/she has rights to, but to actually log him into the Apache server as, in this case, `J.C.Denton`