2

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?


Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

3

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

It is not saying non-root user can perform any kind of direct privilege escalation as a result of this, what it is saying is the log dir should be restricted as their is potential to perform a PE.

Apache is spawned by the root process (needed to bind to port 80) so the logging dir is owned by root. You could theoretically use a public or non-root owned log file as a potential avenue for privilege escalation, e.g non-root user writing files that root would consume, but their are a number of steps needed to do this.

The Apache logs, like any other kind of logs will contain all sorts of juicy information that you definitely do not want to be public.

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777?

Yes. For the reasons mentioned above.

I have no idea what kind of logs you are creating, their are options around all of this (custom log dirs, new users/groups etc) but it all depends on context.

Definitely do not make them public.

  • "It is not saying non-root user can perform any kind of privilege escalation as a direct result of this..." It looks to me like the documentation is saying that. What else could they mean by "gain access to the uid that the server is started as..."? – hft Oct 16 '17 at 16:23
  • @hft "gain access" is a little vague, it's possible they just mean the access to overwrite arbitrary files with log data. I'm not sure why they say apache is normally run as root though, I've always seen it run as apache, www-data, httpd, etc. – AndrolGenhald Oct 16 '17 at 17:05
  • @hft i added a clearer explanation. – Trickycm Oct 16 '17 at 17:48
  • @AndrolGenhald from the docs "In typical operation, Apache is started by the root user, and it switches to the user defined by the User directive to serve hits" usually User is apache (and group is apache). Agree "gain access" is a little vague, I guess it could mean "write access." – hft Oct 16 '17 at 19:29
  • Based on the discussion I think this is probably the right answer. Thanks – hft Oct 16 '17 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.