Re: [gentoo-user] Gentoo location for squirrelmail attachments

[Grant]

>> I ran squirrelmail/configtest.php and realized I don't have an
>> attachment directory set up for Squirrelmail:
>>
>> ERROR: Attachment dir (/var/local/squirrelmail/attach/) does not exist!
>>
>> I don't even have a /var/local/.  Would a good Gentoo'er create the
>> directory in that location?
>
>
> If a website needs to write files, let it do so under its own directory
> hierarchy. All of our PHP sites have something equivalent to the following
> in their apache vhost configs:
>
>  php_admin_value open_basedir /var/www/example.com/www/
>  php_admin_value upload_tmp_dir /var/www/example.com/www/tmp
>  php_admin_value session.save_path /var/www/example.com/www/tmp
>
> That way, if www.example.com is compromised, the rest of the machine is
> still safe (barring PHP bugs).

There is a Squirrelmail document recommending that the Squirrelmail
data and attachments directories are established outside of the web
server's reach.  /var is given as an example.  They also recommend
root:apache 0730 for both directories.

This is a little disturbing because my Squirrelmail data directory was
created under the webroot as apache:apache 0755 at some point.  Would
this have been done by Gentoo?  Should I file a bug?

"Prepare data and attachment directories"
http://squirrelmail.org/docs/admin/admin-3.html

- Grant