1

I changed the APACHE_RUN_GROUP in /etc/apache2/envvars to

APACHE_RUN_GROUP=web-content

because I want Apache to run us www-data:web-content, insetad of www-data:www-data. I hate monotonous manual hacks such as chown -R www-data:web-content. In #Debian, a comrade c.*9 recommend to use ACL, tutorial here, while other comrade H suggested some traditional way and other comrade PP suggested to add www-data to the group web-content (I have it but in this example Apache not running for some reason in the group although /etc/init.d/apache2 restart so 'ps --group web-content' -output here). Now suppose a more generic case, not necessarily Apache.

Loaded questions

  1. How can I make sure a program runs as www-data:web-content?

  2. How can I make sure all files and dirs generated by a program are www-data:web-content instead of www-data:www-data?

  3. How can I make sure a program like Apache runs as www-data:web-content?

3
  • Doesn't matter if you hate it. StackOverflow is a programming resource. Unless you ask a programming question, you're in the wrong place. To make this a programming question, show your attempt to write this. Otherwise, your question is either off-topic or soliciting debate.
    – Graham
    Aug 21, 2012 at 0:23
  • @Graham: you are right. Although I do hate Serverfault, a lot of nasty people there with porn -spam etc, I do see that this question belongs there. Voted as off-topic here. Luckily, I already answered so no need to step there XD
    – hhh
    Aug 21, 2012 at 0:38
  • 1
    Why do you hate us :( There's no porn here...if only...
    – Dan
    Aug 21, 2012 at 9:01

2 Answers 2

2

I will firstly answer questions 1 and 3 because 3 is a special case of 1, the question 2 is actually very simple but let's get our hands dirty!

Apache -case

We firstly perform Apache -specific modification with SED and then make sure Apache is really running with the intended user:group that is www-data:web-content.

# sed -i s@APACHE_RUN_GROUP=www-data@APACHE_RUN_GROUP=web-content@g /etc/apache2/envvars
# /etc/init.d/apache2 restart 
# ps -o pid,user,group,fname $(pidof apache2)
  PID USER     GROUP    COMMAND
24514 root     root     apache2
24521 www-data 1001     apache2
24522 www-data 1001     apache2
24523 www-data 1001     apache2
24524 www-data 1001     apache2
# grep 1001 /etc/group 
web-content:x:1001:www-data,xyz,apache
# getent group 1001
web-content:x:1001:www-data,xyz,apache

where we checked the correspondence of 1001 -placeholder with two different commands for sure so 1001 corresponds to web-content -group. One Apache -process must be running as root:root because it needs to bind to the port 80, according to THE. So now your apache is running as www-data:web-content. You can thank THE and SO for collaborating with this puzzle, welcome to #Debian -channel in Freenode.

General -case

There are actually many ways to Rome:

  • setuid/setgid
  • ...
  • using the start/stop -daemons in /etc/init.d

But according to THE, there is no general way of accomplishing this that would work over all platforms. You need to learn to use the right tool at the right spot. For example, the starting point with Apache -case was to investigate the /etc/apache2/apache2.conf where you found out the /etc/apache2/envvars -file, after reading the comments. Then you just used the /etc/init.d/apache2 restart -command and verified that the program is actually running with intended user:group.

For newbies, I warn about setuid/setgid because easy security -vulnerabilities unless done carefully -- use as you wish with your own machine but use proper auditing in production. But this is no rocket-science! The find -manual in Debian provided this tool that may help you in auditing things, have fuN!

Traverse the filesystem just once, listing setuid files and directories into /root/suid.txt and large files into /root/big.txt.

   find $HOME -mtime 0

Summary

Now I have answered your points 1 and 3, about running a program with certain user:group -combination including Apache (q3 was a special case of question 1). So to the second question, a simple ls -command will make sure that Apache -thing is working correctly like this:

# ls -lsa
total 1832
  4 drwxrwx--- 2 www-data web-content   4096 Aug 20 20:21 .
  4 drwxrwx--- 6 www-data web-content   4096 Aug 14 22:20 ..
884 -rw-r--r-- 1 www-data web-content 900386 Aug 20 20:21 0_hhh.png
 12 -rw-r--r-- 1 www-data web-content   8194 Aug 20 20:21 1_hhh.jpg

Happy puzzling :D

Optional Commands

You may need the following commands. If you need to add the user www-data into the web-content -group, for example because you eventually found a nice fellow A with whom you want to co-operate. They may help you in debugging if something goes wrong, work hard!

  1. It will add the www-data -user into the web-content -group.

    # usermod -a -G web-content www-data

  2. It will show you the user of the process but not the group

    # ps -aux|grep apache

0
  1. If you launch a program as a particular user (not root), it will run as that user.

  2. All files generated by a program will be owned by user running the program and will be in the default group of that user. The program can change the group of a file to any group it is a member of.

  3. To launch a program as a particular user, set the user of a command using the su command. man su for instructions. Note that for Apache, there tends to be a single root-owned process responsible for maintaining logs and launching "handler" processes owned by the user specified in Apache's configuration.

If you want a generic case, look at system commands like su. Otherwise, each program (Apache, nginx, mysql, etc) will handle the process of "dropping privileges" itself, and you'll need to follow the instructions for that particular program.

From the path, user and group you've specified in your question, it sounds as if you may be running Debian or Ubuntu Linux. It's likely that you'll want to follow standards or conventions for your particular platform, in terms of how web server permissions are handled.

3
  • @hhh - the "Debian" label wasn't there when I wrote my answer; when you first posted your question, you tagged it "Unix".
    – ghoti
    Aug 20, 2012 at 13:20
  • @hhh - If you installed Apache from its package (i.e. using apt-get or equivalent), then the package's install script probably created the necessary user and group for Apache's privilege separation. It's almost always a better idea to use a distro's "approved" and "supported" packages and methods rather than rolling your own. If you're writing new server software, consider having its install process create a new user just to own the files manipulated by the server. If privileged access is required for low-numbered ports or log manipulation, follow Apache's example, with a stub and children.
    – ghoti
    Aug 20, 2012 at 13:22
  • @hhh - your question used Apache as an example, but asked for a generic case. I provided that, including a reference to the only ubiquitous shell command that can be used to set your userid, but my answer is "too generic", and you think this deserves a downvote, despite the fact that my answer contains no errors or misinformation? Wow. I'll be sure to skip spending any effort on your future questions.
    – ghoti
    Aug 20, 2012 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .