Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've created a group and a user to run lighttpd.

I would like to run from the web server only files that have these permissions (myuser:mygroup). I don't want to run files with root permissions.

Is this possible?

share|improve this question
add comment

1 Answer

Permissions can help here.

Run lighttpd as a limited user. I believe you can specify the user and group that lighttpd downgrades itself to in lighttpd.conf.

Then, make sure your executable files reachable by lighttpd but owned by root are chmoded to 700. This enables only the root, the file owner to execute them. Careful setting this for directories owned by root, because execute permission on directories is needed to access its contents.

If you are looking to make sure lighttpd can in no way access files other than what you authorize, look into lighttpd's chroot options. This makes a specific directory look like /, the top-level directory, to lighttpd, preventing it from ever getting access to anything "above" that point.

This can be involved if you use script interpreters such as php or perl, as lighttpd needs to be able to access them, so you need to put a copy of them and their dependencies (including config files) in the "chroot jail", as it's called. It's not an issue of just copying the executable, you need to copy all the libraries (this can be discerned with ldd {executable-name}.) and other dependencies and then you're responsible for manually updating it when your php or perl is updated.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.