mod_ruid

Sunday, August 24. 2008

Right ,

I've recently had the pleasure of playing with mod_ruid again, and I've come across an issue with how it functions and mod_cgid,

Normally the cgid unix socket is owned by the userid of the parent process, but because ruid calls setuid it can no longer access the socket due to the permissions, meaning all calls to cgi scripts fail.

I've therefore had to switch out mod_cgid in favour of mod_cgi.

I'm unsure of any other way around this, as changing the permissions on the mod_cgid socket doesn't sound like an ideal solution,

Oh well, running mod_cgi seems to work sufficiently for my needs.

Posted by Keith Ward in General at 22:46 | Comments (2) | Trackbacks (0)

Versioning of entries:

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

What's the harm in making the cgid socket publicly writeable, assuming the majority of users on the box have the ability to create web pages (and hence feed the socket arbitrary data) anyway?

Comment (1)

#1 Henri Cook on 2008-08-25 22:20 (Reply)

Its not recommended to make the socket world writable as from what i've read doing so would compromise the security of cgi scripts, that's why its set by default to mode 0700 and owned by the webserver user.
Also, the permissions on this file get reset to 0700 when the webserver starts up, so its by far easier just to switch to mod_cgi, which doesn't use the socketfile.

Comment (1)

#1.1 Keith (Homepage) on 2008-08-25 22:31 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. BBCode format allowed To leave a comment you must approve it via e-mail, which will be sent to your address after submission.
	Remember Information? Subscribe to this entry