Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on suPHP. I am assuming you use it exactly like PHP and it magically knows to run all scripts as the owner of that script.

I am creating a dynamic website which lets users upload scripts and execute them. Right now this is limited to javascript but I want to also allow them to execute serverside PHP scripts. As the default Apache user is www-data, I want to use suPHP. My idea is to create an intermediate script, lets call it load.php, which takes as an argument the user's target script, lets call it target.php. load.php then checks to see if the user owns target.php, and if they do, launches target.php.

But then what's to stop the user from within target.php issuing a command like (I am not sure if this example is accurate as I can't find any documentation on suPHP).

shell_exec("suphp /home/someOtherUser/test.php");

Does suPHP need a user's password to execute these scripts?


Janne Pikkarainen pointed out that suPHP starts as root, then switches to the owner of a file before executing it. So now I have two questions.

  1. If the PHP script that's executed by suPHP (as the owner, lets call him user1) in turn contains shell_exec("php /home/user2/test.php");, will this return an error since user1 is trying to launch user2's script, or will suPHP kick in again and change from user1 to user2.
  2. what's to stop user1 from executing javascript/HTML code such as <form action="/home/user2/test.php" method="get">?
share|improve this question

migrated from serverfault.com Nov 4 '11 at 12:20

This question came from our site for system and network administrators.

1 Answer 1

up vote 7 down vote accepted

(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO

That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful.

suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php.

How suPHP actually figures out under what account to run the script as is not magic; it simply sees that from the file owner. At beginning suPHP runs as root, and before running the script it just changes the user to be the one owning the file, dropping the root privileges.

EDIT after your own edit: No. Let me explain this one more time. You cannot and should not even attempt to run suPHP via PHP's shell_exec. That's not its idea. Not at all.

suPHP belongs to Apache configuration file httpd.conf, not in individual PHP scripts. There is no exception about that.

Here's suPHP configuration documentation for you.

share|improve this answer
    
LOL reminds me of darth cat –  puk Nov 4 '11 at 11:29
    
I didn't find that documentation too useful. I'll revise my question in light of this. –  puk Nov 4 '11 at 11:31
    
Edited my reply a bit. –  Janne Pikkarainen Nov 4 '11 at 11:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.