From owner-freebsd-questions@FreeBSD.ORG  Mon Jun  2 07:34:37 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 33D6137B401
	for <freebsd-questions@FreeBSD.ORG>;
	Mon,  2 Jun 2003 07:34:37 -0700 (PDT)
Received: from mail.munk.nu (213-152-51-194.dsl.eclipse.net.uk
	[213.152.51.194])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 30AA743F85
	for <freebsd-questions@FreeBSD.ORG>;
	Mon,  2 Jun 2003 07:34:36 -0700 (PDT)
	(envelope-from munk@mail.munk.nu)
Received: from munk by mail.munk.nu with local (Exim 4.20)
	id 19MqOQ-00074Z-N3
	for freebsd-questions@FreeBSD.ORG; Mon, 02 Jun 2003 15:34:34 +0100
Date: Mon, 2 Jun 2003 15:34:34 +0100
From: Jez Hancock <jez.hancock@munk.nu>
To: freebsd-questions@FreeBSD.ORG
Message-ID: <20030602143434.GA26007@users.munk.nu>
Mail-Followup-To: freebsd-questions@FreeBSD.ORG
References: <200306021618.02280.mdv@unsavoury.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200306021618.02280.mdv@unsavoury.net>
User-Agent: Mutt/1.4.1i
Sender: User Munk <munk@mail.munk.nu>
Subject: Re: safely running php scripts
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Jun 2003 14:34:37 -0000

On Mon, Jun 02, 2003 at 04:18:02PM +0200, Maarten de Vries wrote:
> Hi,
> 
> I would like the php scripts that are hosted on my Apache server (FreeBSD 
> 4.8), to run under the UID/GID's that belong to the useraccounts in 
> question; not the webservers'.
> Before, I patched Apache so it ran php's under SuExec, but now the php 
> standalonebinary port has disappeared, so that seems to be not an option 
> anymore.
> 
> Any pointers to set it all up in a safe manner again would be much 
> appreciated!
Read up on safe_mode and open_basedir.
A sample vhost stub using the two in conjunction:

<VirtualHost *>
	ServerName www.example.com
	DocumentRoot /home/example/web
	php_admin_value safe_mode 1
	php_admin_value open_basedir /home/example/web
</VirtualHost>

the open_basedir line restricts users to only operating on files under
/home/example/web (ie stops users from 'snooping' on other user's
files).

The safe_mode line restricts the functionality of a large
number of PHP functions - not to mention checking that the user who owns
the script also owns the files the script attempts to operate on (this
is from memory though, checkout the chapter on safe mode in the manual
for detailed info).

AFAIK this is the closest PHP gets to running a script under the same
UID/GID as the user/group that owns the script.