Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (hermes.apache.org: domain of jslive@gmail.com designates
 66.249.82.233 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=gkeYpTUjs6pT014HGU+OXKJmJ+JOADz31bMA8P9f/pJl+Lmo2PBsqMA0bQ/XFqolQDrapoGg3UaqrYBn9cx42/lOgoj2U2bQv6H5buJE2HfcsuvtlTx4PjhnQ8V+gOKubJiB3MHaIDLeu8ka5JTzP5KyqeIG3Qavgzi1xhsFwpA=
Message-ID: <e498c1660609151131y66923ea9o2d7f3a766d42cc23@mail.gmail.com>
Date: Fri, 15 Sep 2006 14:31:01 -0400
From: "Joshua Slive" <joshua@slive.ca>
Sender: jslive@gmail.com
To: users@httpd.apache.org
In-Reply-To: <29543.142.56.86.23.1158263346.squirrel@moutarde.zioup.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <29543.142.56.86.23.1158263346.squirrel@moutarde.zioup.com>
Subject: Re: [users@httpd] Question about suexec

On 9/14/06, Yves Dorfsman <yves@zioup.com> wrote:
>
>
> Anybody has any idea if it's possible to do something like:
>
> SuexecUserGroup $REMOTE_USER agroup
>
> What I'm trying to do, is have the CGIs executed with the uid of the
> authenticating user, but everybody will be using the same script, and the
> same URL.
>
> I've googled for it, and there are hints that people are doing this out
> there, but no example of configuration (the one above is of course
> completely invalid). On one page one guy's saying that he re-wrote su-exec
> to be able to do all sort of things... but I really want to stay as close to
> vanilla as possible.

No, this is not possible and not wise.  You would need to strip away
the most important security protections of suexec to do this.

If you really need this, look into sudo, which could be used in
conjunction with suexec or in an ordinary cgi script.  But watch out.
You could easily create massive security wholes if you don't know what
you are doing.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org