Bug 350831 - reduce suexec minimum gid
Summary: reduce suexec minimum gid
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: httpd
Version: 5.0
Hardware: All
OS: Linux
low
low
Target Milestone: ---
: ---
Assignee: Joe Orton
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-10-24 17:22 UTC by Kenneth Porter
Modified: 2009-10-13 14:15 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-10-13 14:15:59 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Kenneth Porter 2007-10-24 17:22:55 UTC
When installing a daemon package that can use suexec to avoid a separate httpd
instance (in my case, backuppc), one must set the UID of the package user to
greater than 500 to use suexec with its management CGI. This conflicts with the
band of UID's reserved for end-user assignment. Ideally suexec's AP_UID_MIN
should be somewhat below 500, to allow a band of UIDs for use by system services
needing a web management interface.

See also bug 107083 and bug 127667, where the minimum GID was reduced from 500
to 100.

Comment 1 Joe Orton 2007-11-01 11:36:25 UTC
It is rather than point of the minimum GID/UID to *avoid* being able to use
suexec with "system" users.  The minimum GID was lowered only because of the
issue with the existing gid=100 users group (essentially, a migration issue).

Comment 2 Kenneth Porter 2007-11-08 18:12:07 UTC
Would it be preferable, then, to run multiple Apache instances as different
users? If so, should I enter an RFE against httpd to provide initscripts that
can launch multiple instances?

Comment 3 Joe Orton 2009-10-13 14:15:59 UTC
Sorry that I never responded to that question.  Really the only "preferable" option here is to ensure both your uids and gids are >= 500.

Marking closed since the minimum uid is set deliberately for security purposes; apologies that this is unsatisfying for some deployments.


Note You need to log in before you can comment on or make changes to this bug.