One nice thing about having all dynamic content being generated by CGI is that you can use suEXEC to run the scripts as a different user. This is primarily used for systems where you have multiple untrusted users who run sites in one HTTP server. Then no one can interfere with anyone else. It can also be used simply for separating the application from the server.
I’m the only user on my server so I don’t necessarily have any of these security concerns, but I have enabled suEXEC for convenience. For example, WordPress will allow you to modify the stylesheets from the admin interface as long as it can write to them. With suEXEC, the admin interface can run as my Unix user, so I can edit the files from both the web interface and the command line without having wide-open permissions or switching to root.
Same applies for Trac where I can manage the project with the web interface or trac-admin on the command line. The same effect could pretty much be obtained by using Unix groups properly:
# groupadd wordpress # usermod -G wordpress webservd # usermod -G wordpress jlee # my username # chgrp -R wordpress /docs/thestaticvoid.com # virtualhost document root # chmod -R g+ws /docs/thestaticvoid.com # make directory writable and always owned by the wordpress group
Then umask 002 would have to be set in Apache’s and my profile so any files that get created can be written to by the other users in the group. That’s all well and good, but it seems like a bit of work and I don’t like the idea of messing with the default umask.
On to suEXEC. First, let’s show the current user that PHP executes as. Create a file test.php containing <?php echo exec("id"); ?>. Accessing the script from your web browser should show something like uid=80(webservd) gid=80(webservd).
Next, in OpenSolaris, the suexec binary must be enabled:
# cd /usr/apache2/2.2/bin/ # go one directory further into the amd64 dir
if you're running 64-bit
# mv suexec.disabled suexec
# chown root:webservd suexec
# chmod 4750 suexec
# ./suexec -V
-D AP_DOC_ROOT="/var/apache2/2.2/htdocs"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="webservd"
-D AP_LOG_EXEC="/var/apache2/2.2/logs/suexec_log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX="public_html"
These variables were set at compile time and cannot be changed. They ensure that certain conditions must be met in order to use the binary. That’s very important because it’s setuid root. The first thing I had to do was move everything from my old document root to the one specified above in AP_DOC_ROOT. Then you can add SuexecUserGroup jlee jlee (with whatever username and group you want the scripts to run as) to your <VirtualHost> section of the Apache configuration. At this point if you try to execute test.php you’ll probably see one of a couple errors in the suEXEC log (/var/apache2/2.2/logs/suexec_log):
- [2009-07-27 11:08:02]: uid: (1000/jlee) gid: (1000/jlee) cmd: php-cgi
[2009-07-27 11:08:02]: command not in docroot (/usr/php/bin/php-cgi)
In this case, php-cgi is going to have to be moved to the document root:$ cp /usr/php/bin/php-cgi /var/apache2/2.2/htdocs/ $ pfexec vi /etc/apache2/2.2/conf.d/php-cgi.conf # modify the ScriptAlias appropriately $ svcadm restart http - [2009-07-27 11:11:07]: uid: (1000/jlee) gid: (1000/jlee) cmd: php-cgi
[2009-07-27 11:11:07]: target uid/gid (1000/1000) mismatch with directory (0/2) or program (0/0)
Make sure everything that suexec is to execute is owned by the same user and group as specified in theSuexecUserGroupline of your Apache configuration.
Now, running test.php should give the correct results: uid=1000(jlee) gid=1000(jlee). Done!
As a side note, I lose all frame of reference while I write so I can’t remember if I’m writing this for you or me, explaining what I’ve done or what you should do. Sorry 🙂