Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Tue, 22 Feb 2011 20:04:53 +0300
From: Alexander GQ Gerasiov <gq@cs.msu.su>
To: dev@httpd.apache.org
Subject: Configurable suexec bin
Message-ID: <20110222200453.08c466a1@cs.msu.su>
Reply-To: gq@cs.msu.su
Organization: Home Inc.
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Hello there.

Some days ago I found that I'm tired of original suexec which is
shipped with apache.
I have two issues:

1.I'd like to configure it with config file, not with rebuilding,
because I use modern OS with package system and don't want to depend on
self-compiled components.
2.I'd like to use apache2+fcgid+suexec+php5. But with original suexec I
had to put dumb script to every users docroot, which only
execs /usr/bin/php-cgi. So I just want to allow suexec execute some
commands out of docroot tree and owned by the users other that one we
setuid to.

That's why I created a little bit patched version of suexec, called
suexec-conf: https://github.com/gerasiov/suexec-conf

Please take a look at this small project and comment. I tried not to
lessen security a lot, but may be I've made some errors.

I plan to upload it to Debian, so I could use apache+fcgid+suexec+php5
out of the box on any Debian server.

PS Yes, I know about mpm-itk, but for some reason, I prefere threaded
mpm + suexec


-- 
Best regards,
 Alexander GQ Gerasiov

 Contacts:
 e-mail:    gq@cs.msu.su             Jabber:  gq@jabber.ru
 Homepage:  http://gq.net.ru         ICQ:     7272757
 PGP fingerprint: 04B5 9D90 DF7C C2AB CD49  BAEA CA87 E9E8 2AAC 33F1