Return to Question

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? It looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]