[gentoo-hardened] Tikiwiki temporary files in / !

[Tóth Attila]

Hi,

I'm just fine-tuning a machine running Hardened Gentoo Linux. I started
from stage1 and build the whole system with USE hardened. I have ~x86
also. I set up tikiwiki CMS from portage (v1.8.2 Sirius). Other remarkable
versions: Apache:2.0.50, mod_ssl:2.0.50, OpenSSL:0.9.7d, PHP:4.3.8.I'm about to work out an ACL system based on Grsecurity, being in the
evaluation period for the required ACLs. I noticed a strange symptom, that
apache2 keeps creating some kind of temporary files in the root directory
(I mean real root, not the www root) with scrambled names, which it
immediately erases. It also uses /tmp with similar srambled names.Other php based web programs (squirrelmail, phpscheduleit) do not show
this phenomenon.As it was highlighted, I had to notice that apache tries to write in /.
Although I specified to run as apache:apache in commonapache2.conf, after
executing /etc/init.d/apache2 start, one instance of the httpd remains
root, the others continue to run as apache. Is it the normal behaviour?Php session files are stored in a separate folder for security reasons,
php-accelerator uses exclusively /tmp directory.
What can be the reason? Has anyone experienced the same?
I haven't find any configuration options in possible conjunction with this
issue.
I suspect multiple problems here. Firstly: why apache run under root, if I
set it to apache:apache, secondly: why it tries to create directories in
/?In addition - to make this issue more complicated - the learned acl rules
show, that apache2 tries to create these damned files only as apache, not
as root (it is listed only in the apache role not in the root role).
Please share your ideas and suggestions.

Thx,
Dw.

-- 
dr Tóth Attila, Radiológus Rezidens, 06-30-5962-962
Attila Toth MD, Radiology Resident, [phone]



--
gentoo-hardened@g.o mailing list