Bug 350831

Summary:	reduce suexec minimum gid
Product:	Red Hat Enterprise Linux 5	Reporter:	Kenneth Porter <shiva>
Component:	httpd	Assignee:	Joe Orton <jorton>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	5.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-10-13 14:15:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kenneth Porter 2007-10-24 17:22:55 UTC

When installing a daemon package that can use suexec to avoid a separate httpd
instance (in my case, backuppc), one must set the UID of the package user to
greater than 500 to use suexec with its management CGI. This conflicts with the
band of UID's reserved for end-user assignment. Ideally suexec's AP_UID_MIN
should be somewhat below 500, to allow a band of UIDs for use by system services
needing a web management interface.

See also bug 107083 and bug 127667, where the minimum GID was reduced from 500
to 100.

Comment 1 Joe Orton 2007-11-01 11:36:25 UTC

It is rather than point of the minimum GID/UID to *avoid* being able to use
suexec with "system" users.  The minimum GID was lowered only because of the
issue with the existing gid=100 users group (essentially, a migration issue).

Comment 2 Kenneth Porter 2007-11-08 18:12:07 UTC

Would it be preferable, then, to run multiple Apache instances as different
users? If so, should I enter an RFE against httpd to provide initscripts that
can launch multiple instances?

Comment 3 Joe Orton 2009-10-13 14:15:59 UTC

Sorry that I never responded to that question.  Really the only "preferable" option here is to ensure both your uids and gids are >= 500.

Marking closed since the minimum uid is set deliberately for security purposes; apologies that this is unsatisfying for some deployments.