On Wed, 28 Sep 2005 15:02:17 +0000 Pedro Venda <[EMAIL PROTECTED]> wrote:
> On Wednesday 28 September 2005 07:16, Julius Loman wrote: > > On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki > <[EMAIL PROTECTED]> wrote: > > > On Tuesday, September 27, 2005 23:57, Julius Loman wrote: > > > > For security reasons I want to have php scripts running > > > > under file owner UID. > > > > > > PHP's "safe mode" might offer the security that you're looking > > > for. > > > > I don't think so, at least files created by php scripts will be > > created with UID that php is running. I don't want this, so do > > users. > > This is indeed a serious issue and it deserves attention from careful > sysadmins. > > On my previous sysadmin job, me and my team discussed this issue > exactly. we were a team of sysadmins that (between many other things) > handled a sun solaris server with about 8000 user accounts. > > I can't remember all the arguments, but: > - suphp was abandoned due to poor testing and not supporting solaris > well; > - we didn't know fastcgi, but I assume it works by running php > scripts through a shell interpreter called as a cgi. it's an option, > and it doesn't require fastcgi... still it caused us trouble because > the interpreter was being called with the apache owner. the suexec > module has some limitations on this, since the php scripts didn't > have .cgi extensions. > > our solution involved patching apache's suexec to handle .php scripts > just like .cgi ones, running the interpreter on them. > > the guy who patched the suexec (and worked with me then) is on this > list and I believe he'll give it to you, if it looks pretty enough. > (CC'd him) > > as for performance, it surely dropped but we didn't really measure it > with numbers. that wasn't really the main concern. > > regards, > pedro venda. Hi, Maybe you all know this, but just to mention it - for quite a few of the daemons there're ready to use (selinux) policy configurations. SELinux policy ebuilds. Check all them by:"#eix selinux | grep policy". Unfortunately there's none for PHP, so somebody might want to write one and submit it for all the others to use. Think that using an MAC system by itself is quite a defence, all the other solutions will be weaker. Just my point here. PS: sorry but can't (easy) do this myself as i use RSBAC not SELinux. HTH.Rumen
pgphFw0YmNKbQ.pgp
Description: PGP signature
