|
|
Posted by fletch on 04/25/06 00:51
>> Which may be your userid, which may be the userid you use for ftp.
>
> In that case the PHP application didn't create it. FTP did. It may have been
> driven by the PHP application, but it's not the application working directly on
> the filesystem.
I should be clearer. Apache can run with suExec, and often does in a
shared hosting environment. This means that the particular apache
process which runs a script runs with the uid and gid of that script.
The host will then ensure that the files in the user's directory have
the correct uid and gid bits set. This means that the uid of an ftp'd
file and a file created by php run through apache will be the same.
Just a foot note to the main point of the thread.
>From http://httpd.apache.org/docs/1.3/suexec.html
> The suEXEC feature -- introduced in Apache 1.2 -- provides Apache users the ability to run CGI and
> SSI programs under user IDs different from the user ID of the calling web-server. Normally, when a
> CGI or SSI program executes, it runs as the same user who is running the web server.
>
> Used properly, this feature can reduce considerably the security risks involved with allowing users
> to develop and run private CGI or SSI programs. However, if suEXEC is improperly configured, it
> can cause any number of problems and possibly create new holes in your computer's security. If
> you aren't familiar with managing setuid root programs and the security issues they present, we
> highly recommend that you not consider using suEXEC.
Navigation:
[Reply to this message]
|