I'm hosting a simple wsgi application on httpd over CentOS 7 using
mod_wsgi and trying to remove the isolation illustrated below.
The following script is my
- it creates a file called
- enumerates the content of
/tmpas a simple json list
def application(environ, start_response): status = '200 OK' headers = [('Content-Type', 'application/json')] start_response(status, headers) with open('/tmp/test-wsgi.txt', 'w+') as w: w.write('hello world') files = os.listdir('/tmp') return json.dumps(files)
When i'm accessing my web application i'm getting the following response
Great so far!
Connected to the same hosting server as root,
I've opened a shell and executed
From playing around with it, seems that any filesystem operation (enumeration/creation/socket access) inside my wsgi script is "environmently isolated" (like chroot jail). the strange thing is i haven't configured any of that type of isolation.
<VirtualHost *:80> DocumentRoot /opt/my-app/ WSGIScriptAlias / /opt/my-app/apache/wsgi.py <Directory /opt/my-app/apache> Order allow,deny Allow from all Require all granted </Directory> </VirtualHost>
... User apache Group apache ...