1 |
On Wed, 28 Sep 2005 15:02:17 +0000 |
2 |
Pedro Venda <pjvenda@××××××××××××.org> wrote: |
3 |
|
4 |
> On Wednesday 28 September 2005 07:16, Julius Loman wrote: |
5 |
> > On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki |
6 |
> <agorecki@××××××××××.com> wrote: |
7 |
> > > On Tuesday, September 27, 2005 23:57, Julius Loman wrote: |
8 |
> > > > For security reasons I want to have php scripts running |
9 |
> > > > under file owner UID. |
10 |
> > > |
11 |
> > > PHP's "safe mode" might offer the security that you're looking |
12 |
> > > for. |
13 |
> > |
14 |
> > I don't think so, at least files created by php scripts will be |
15 |
> > created with UID that php is running. I don't want this, so do |
16 |
> > users. |
17 |
> |
18 |
> This is indeed a serious issue and it deserves attention from careful |
19 |
> sysadmins. |
20 |
> |
21 |
> On my previous sysadmin job, me and my team discussed this issue |
22 |
> exactly. we were a team of sysadmins that (between many other things) |
23 |
> handled a sun solaris server with about 8000 user accounts. |
24 |
> |
25 |
> I can't remember all the arguments, but: |
26 |
> - suphp was abandoned due to poor testing and not supporting solaris |
27 |
> well; |
28 |
> - we didn't know fastcgi, but I assume it works by running php |
29 |
> scripts through a shell interpreter called as a cgi. it's an option, |
30 |
> and it doesn't require fastcgi... still it caused us trouble because |
31 |
> the interpreter was being called with the apache owner. the suexec |
32 |
> module has some limitations on this, since the php scripts didn't |
33 |
> have .cgi extensions. |
34 |
> |
35 |
> our solution involved patching apache's suexec to handle .php scripts |
36 |
> just like .cgi ones, running the interpreter on them. |
37 |
> |
38 |
> the guy who patched the suexec (and worked with me then) is on this |
39 |
> list and I believe he'll give it to you, if it looks pretty enough. |
40 |
> (CC'd him) |
41 |
> |
42 |
> as for performance, it surely dropped but we didn't really measure it |
43 |
> with numbers. that wasn't really the main concern. |
44 |
> |
45 |
> regards, |
46 |
> pedro venda. |
47 |
Hi, |
48 |
Maybe you all know this, but just to mention it - for quite a few of |
49 |
the daemons there're ready to use (selinux) policy configurations. |
50 |
SELinux policy ebuilds. Check all them by:"#eix selinux | grep policy". |
51 |
Unfortunately there's none for PHP, so somebody might want to write |
52 |
one and submit it for all the others to use. |
53 |
Think that using an MAC system by itself is quite a defence, all the |
54 |
other solutions will be weaker. Just my point here. |
55 |
PS: sorry but can't (easy) do this myself as i use RSBAC not SELinux. |
56 |
HTH.Rumen |