How to block the execution of files owned by root through lighttpd?

Question

I've created a group and a user to run lighttpd.

I would like to run from the web server only files that have these permissions (myuser:mygroup). I don't want to run files with root permissions.

Is this possible?

Answer 1

Permissions can help here.

Run lighttpd as a limited user. I believe you can specify the user and group that lighttpd downgrades itself to in lighttpd.conf.

Then, make sure your executable files reachable by lighttpd but owned by root are chmoded to 700. This enables only the root, the file owner to execute them. Careful setting this for directories owned by root, because execute permission on directories is needed to access its contents.

If you are looking to make sure lighttpd can in no way access files other than what you authorize, look into lighttpd's chroot options. This makes a specific directory look like /, the top-level directory, to lighttpd, preventing it from ever getting access to anything "above" that point.

This can be involved if you use script interpreters such as php or perl, as lighttpd needs to be able to access them, so you need to put a copy of them and their dependencies (including config files) in the "chroot jail", as it's called. It's not an issue of just copying the executable, you need to copy all the libraries (this can be discerned with ldd {executable-name}.) and other dependencies and then you're responsible for manually updating it when your php or perl is updated.