Following on why should we restrict Apache users, another two questions arises:
- What is the recommended method of restricting the places Apache users can traverse & read in the file system?
- What to do against fork bombs and other shell scripting problems? (bash scripting is allowed)
My possible solutions (I prefer to know which solution you choose and why):
- chroot OR mod_chroot
- disable bash OR use Restricted BASH
Please offer another solutions if you find appropriate. (perhaps selinux is?)
Current status:
- Users are allowed to executed bash scripts (via PHP for example)
- suexec is active
- Apache requests are served with FastCGI for PHP
Edit:
Sorry for not supplying the bounty yet. The final thing that I need to know is about question #2: when bash scripting is allowed via PHP, how can I defend my system from attacks (fork bombs, reading sensitive data)? Can SELinux/Apparmor defend against those things?