On Wed, Sep 28, 2005 at 07:58:59PM +0300, Rumen Yotov <[EMAIL PROTECTED]> wrote: > On Wed, 28 Sep 2005 15:02:17 +0000 > Pedro Venda <[EMAIL PROTECTED]> wrote: > > > On Wednesday 28 September 2005 07:16, Julius Loman wrote: > > > On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki > > <[EMAIL PROTECTED]> wrote: > > > > On Tuesday, September 27, 2005 23:57, Julius Loman wrote: > > > > > For security reasons I want to have php scripts running > > > > > under file owner UID. > > > > > > > > PHP's "safe mode" might offer the security that you're looking > > > > for. > > > > > > I don't think so, at least files created by php scripts will be > > > created with UID that php is running. I don't want this, so do > > > users. > > > > This is indeed a serious issue and it deserves attention from careful > > sysadmins. > > > > On my previous sysadmin job, me and my team discussed this issue > > exactly. we were a team of sysadmins that (between many other things) > > handled a sun solaris server with about 8000 user accounts. > > > > I can't remember all the arguments, but: > > - suphp was abandoned due to poor testing and not supporting solaris > > well; > > - we didn't know fastcgi, but I assume it works by running php > > scripts through a shell interpreter called as a cgi. it's an option, > > and it doesn't require fastcgi... still it caused us trouble because > > the interpreter was being called with the apache owner. the suexec > > module has some limitations on this, since the php scripts didn't > > have .cgi extensions. > > > > our solution involved patching apache's suexec to handle .php scripts > > just like .cgi ones, running the interpreter on them. > > > > the guy who patched the suexec (and worked with me then) is on this > > list and I believe he'll give it to you, if it looks pretty enough. > > (CC'd him) > > > > as for performance, it surely dropped but we didn't really measure it > > with numbers. that wasn't really the main concern. > > > > regards, > > pedro venda. > Hi, > Maybe you all know this, but just to mention it - for quite a few of > the daemons there're ready to use (selinux) policy configurations. > SELinux policy ebuilds. Check all them by:"#eix selinux | grep policy". > Unfortunately there's none for PHP, so somebody might want to write > one and submit it for all the others to use. > Think that using an MAC system by itself is quite a defence, all the > other solutions will be weaker. Just my point here. > PS: sorry but can't (easy) do this myself as i use RSBAC not SELinux. > HTH.Rumen yes, but unfortunately i haven't found a policy for suphp or fastcgi.. suexec will work i think... but patching suexec everytime i'm upgrading apache is not an idea i like
-- [ Julius Loman ][ [EMAIL PROTECTED] ][ http://lomo.kyberia.net ][ icq:35732873 ]
pgpAmB26oY4pB.pgp
Description: PGP signature
