I'm using a custom compiled installation of Apache + PHP, listening on port
Apache is configured to run as a normal user, with the proper settings
Group of the
After running apache as a service, with
apachectl, there's one process
httpd running by root, and 4 others running by that normal user.
The problem is this:
- When I run an external command by PHP (using
passthrufor instance), it's run by the proper normal user, but
$HOMEenvironment variable points to
For example, with the following very simple code:
<?php echo "Home: " . `echo \$HOME`; echo "<br />"; echo "Id: " . `id`;
Home: /root Id: uid=1000(normaluser) gid=100(users) groups=100(users),17(audio),33(video)
Any command run this way, is actually run by the normal user, so there's no security problem. The major problem is when an external command is run, and that command tries to write and/or read something from the home directory.