Re: [gentoo-hardened] running php scripts as owner

[Julius Loman]

On Wed, Sep 28, 2005 at 07:58:59PM +0300, Rumen Yotov <rumen_yotov@×××.bg> wrote:
> On Wed, 28 Sep 2005 15:02:17 +0000
> Pedro Venda <pjvenda@××××××××××××.org> wrote:
>
> > On Wednesday 28 September 2005 07:16, Julius Loman wrote:
> > > On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki
> > <agorecki@××××××××××.com> wrote:
> > > > On Tuesday, September 27, 2005 23:57, Julius Loman wrote:
> > > > > For security reasons I want to have php scripts running
> > > > > under file owner UID.
> > > >
> > > > PHP's "safe mode" might offer the security that you're looking
> > > > for.
> > >
> > > I don't think so, at least files created by php scripts will be
> > > created with UID that php is running. I don't want this, so do
> > > users.
> >
> > This is indeed a serious issue and it deserves attention from careful
> > sysadmins.
> >
> > On my previous sysadmin job, me and my team discussed this issue
> > exactly. we were a team of sysadmins that (between many other things)
> > handled a sun solaris server with about 8000 user accounts.
> >
> > I can't remember all the arguments, but:
> > - suphp was abandoned due to poor testing and not supporting solaris
> > well;
> > - we didn't know fastcgi, but I assume it works by running php
> > scripts through a shell interpreter called as a cgi. it's an option,
> > and it doesn't require fastcgi... still it caused us trouble because
> > the interpreter was being called with the apache owner. the suexec
> > module has some limitations on this, since the php scripts didn't
> > have .cgi extensions.
> >
> > our solution involved patching apache's suexec to handle .php scripts
> > just like .cgi ones, running the interpreter on them.
> >
> > the guy who patched the suexec (and worked with me then) is on this
> > list and I believe he'll give it to you, if it looks pretty enough.
> > (CC'd him)
> >
> > as for performance, it surely dropped but we didn't really measure it
> > with numbers. that wasn't really the main concern.
> >
> > regards,
> > pedro venda.
> Hi,
> Maybe you all know this, but just to mention it - for quite a few of
> the daemons there're ready to use (selinux) policy configurations.
> SELinux policy ebuilds. Check all them by:"#eix selinux | grep policy".
> Unfortunately there's none for PHP, so somebody might want to write
> one and submit it for all the others to use.
> Think that using an MAC system by itself is quite a defence, all the
> other solutions will be weaker. Just my point here.
> PS: sorry but can't (easy) do this myself as i use RSBAC not SELinux.
> HTH.Rumen
yes, but unfortunately i haven't found a policy for suphp or fastcgi..
suexec will work i think... but patching suexec everytime i'm upgrading
apache is not an idea i like


-- 

[ Julius Loman ][ lomo@×××××××.net ][ http://lomo.kyberia.net ][ icq:35732873 ]