I use PHP-FPM in a shared hosting configuration. Each FPM pool runs as a different user. Apache runs as www-data. Apache connects via a socket using mod_proxy_fcgi. I allow users to use .htaccess files.
How do I prevent a user from connecting to the wrong FPM pool?
The vhost looks something like this:
<VirtualHost *:80> ServerName foo.com DocumentRoot /var/www/sites/foo.com/html <FilesMatch "\.php$"> SetHandler "proxy:unix:/var/run/foo-com-fpm.sock|fcgi://localhost" </FilesMatch> </VirtualHost>
But, the foo-com user can easily override that handler from his .htaccess:
<FilesMatch "\.php$"> SetHandler "proxy:unix:/var/run/bar-com-fpm.sock|fcgi://localhost" </FilesMatch>
This would allow him to run PHP scripts as a different user. How can I prevent that, without disallowing FileInfo overrides?