[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [cobalt-developers] Security issues with running files owned by httpd under a virtual site.



On Sun, 24 Jun 2001, KAMRY wrote:

> 
> But how would someone other than root or httpd write to the folders. In
> other words, for the cgi/perl script you mentioned, how would it be written
> in those dir owned by httpd. Remember under /web we have a folder owned by
> httpd and grouped as httpd with r-x only.
> 
> Am I missing something,,,,
> 
> KAL
> 
You said the answer yourself, I believe.

You said that the owner is http, right?

Say the owner is "joe". can joe change the permissions to rwx? I believe
he can. Can joe run a script (which inherits his permissions) to do the
same? Sure, he can.

So why would httpd not? :)

- shimi.