How to prevent excutable files run in the DOCUMENT_ROOT

fluke · 2005-08-19 09:44:06

How to prevent excutable files run in the DOCUMENT_ROOT of the apache server?

I just want it to run in /var/www/cgi-bin but not /var/www/html

As far as I know, there is a module called SELinux in Fedora Core to protect the DOCUMENT_ROOT.

cactus · 2005-08-19 15:05:50

that is not the main purpose of selinux.
lol

As for preventing execs from running in doc root..just set the -Executable option on that directory in the apache conf. (or something like that)
Then you just add executable to the cgi-bin dir...it should be setup like that by default..

fluke · 2005-08-20 04:08:33

Yes, I know, its purpose is to protect the whole file system.
But, my web scrpit can exex a command which can output files to any path.
For example, I can exec("gcc foo.c -o /home/fluke/foo");
And I must have exec function work, for my project will run command frequently.
I just want that it can only generate files in some specify paths.

cactus · 2005-08-20 04:30:08

I guess i just dont get it. chalk it up to a language barrier, or me not understanding...
if you script is not executable (noexecute setting in apache, not in filesystem) then it shouldn't matter..

if you do want at to be execute, but just want to control "where" it executes, you might consider running a chroot or something early in the script.
and for gods sake..dont allow user input to ever determine a path or filename directly...

/me shivvers

fluke · 2005-09-21 08:00:53

I must do that, for I need to run some programs via php.
I just want to prevent scripts from running in web_root, except some special paths. And I want to implement this function in system layer. Like SELinux do.

Arch Linux

#1 2005-08-19 09:44:06

How to prevent excutable files run in the DOCUMENT_ROOT

#2 2005-08-19 15:05:50

Re: How to prevent excutable files run in the DOCUMENT_ROOT

#3 2005-08-20 04:08:33

Re: How to prevent excutable files run in the DOCUMENT_ROOT

#4 2005-08-20 04:30:08

Re: How to prevent excutable files run in the DOCUMENT_ROOT

#5 2005-09-21 08:00:53

Re: How to prevent excutable files run in the DOCUMENT_ROOT

Board footer