I will firstly answer questions 1 and 3 because 3 is a special case of 1, the question 2 is actually very simple but let's get our hands dirty!
Apache -case
We firstly perform Apache -specific modification with SED and then make sure Apache is really running with the intended user:group
that is www-data:web-content
.
# sed -i s@APACHE_RUN_GROUP=www-data@APACHE_RUN_GROUP=web-content@g /etc/apache2/envvars
# /etc/init.d/apache2 restart
# ps -o pid,user,group,fname $(pidof apache2)
PID USER GROUP COMMAND
24514 root root apache2
24521 www-data 1001 apache2
24522 www-data 1001 apache2
24523 www-data 1001 apache2
24524 www-data 1001 apache2
# grep 1001 /etc/group
web-content:x:1001:www-data,xyz,apache
# getent group 1001
web-content:x:1001:www-data,xyz,apache
where we checked the correspondence of 1001 -placeholder with two different commands for sure so 1001 corresponds to web-content -group. One Apache -process must be running as root:root
because it needs to bind to the port 80, according to THE. So now your apache is running as www-data:web-content
. You can thank THE and SO for collaborating with this puzzle, welcome to #Debian -channel in Freenode.
General -case
There are actually many ways to Rome:
setuid/setgid
- ...
- using the start/stop -daemons in
/etc/init.d
But according to THE, there is no general way of accomplishing this
that would work over all platforms. You need to learn to use the right
tool at the right spot. For example, the starting point with Apache
-case was to investigate the /etc/apache2/apache2.conf
where you found out the /etc/apache2/envvars
-file, after reading the
comments. Then you just used the /etc/init.d/apache2 restart
-command and verified that the program is actually running with intended user:group
.
For newbies, I warn about setuid/setgid
because easy security
-vulnerabilities unless done carefully -- use as you wish with your own machine but use proper auditing in production. But this is no
rocket-science! The find
-manual in Debian provided this tool that
may help you in auditing things, have fuN!
Traverse the filesystem just once, listing setuid files and
directories into /root/suid.txt and large files into /root/big.txt.
find $HOME -mtime 0
Summary
Now I have answered your points 1 and 3, about running a program with
certain user:group
-combination including Apache (q3 was a special
case of question 1). So to the second question, a simple ls
-command
will make sure that Apache -thing is working correctly like this:
# ls -lsa
total 1832
4 drwxrwx--- 2 www-data web-content 4096 Aug 20 20:21 .
4 drwxrwx--- 6 www-data web-content 4096 Aug 14 22:20 ..
884 -rw-r--r-- 1 www-data web-content 900386 Aug 20 20:21 0_hhh.png
12 -rw-r--r-- 1 www-data web-content 8194 Aug 20 20:21 1_hhh.jpg
Happy puzzling :D
Optional Commands
You may need the following commands. If you need to add the user www-data
into the web-content
-group, for example because you eventually found a nice fellow A
with whom you want to co-operate. They may help you in debugging if something goes wrong, work hard!
It will add the www-data -user into the web-content -group.
# usermod -a -G web-content www-data
It will show you the user of the process but not the group
# ps -aux|grep apache