Re: [gentoo-hardened] running php scripts as owner

[Pedro Venda]

On Wednesday 28 September 2005 07:16, Julius Loman wrote:
> On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki
<agorecki@××××××××××.com> wrote:
> > On Tuesday, September 27, 2005 23:57, Julius Loman wrote:
> > > For security reasons I want to have php scripts running
> > > under file owner UID.
> >
> > PHP's "safe mode" might offer the security that you're looking for.
>
> I don't think so, at least files created by php scripts will be created
> with UID that php is running. I don't want this, so do users.

This is indeed a serious issue and it deserves attention from careful 
sysadmins.

On my previous sysadmin job, me and my team discussed this issue exactly. we 
were a team of sysadmins that (between many other things) handled a sun 
solaris server with about 8000 user accounts.

I can't remember all the arguments, but:
- suphp was abandoned due to poor testing and not supporting solaris well;
- we didn't know fastcgi, but I assume it works by running php scripts through 
a shell interpreter called as a cgi. it's an option, and it doesn't require 
fastcgi... still it caused us trouble because the interpreter was being 
called with the apache owner. the suexec module has some limitations on this, 
since the php scripts didn't have .cgi extensions.

our solution involved patching apache's suexec to handle .php scripts just 
like .cgi ones, running the interpreter on them.

the guy who patched the suexec (and worked with me then) is on this list and I 
believe he'll give it to you, if it looks pretty enough. (CC'd him)

as for performance, it surely dropped but we didn't really measure it with 
numbers. that wasn't really the main concern.

regards,
pedro venda.
-- 

Pedro João Lopes Venda
email: pjvenda < at > arrakis.dhis.org
http://arrakis.dhis.org