The organization I work for is very security-minded. There is a separation between the group of System Administrators who are responsible for the operating systems (who, obviously, have root) and those of us who maintain the services that run on those operating systems (of which I would be one, and we are not to have access to root except constrained via sudo).
I am currently in the process of redesigning how we maintain our Apache configuration. The new setup will be running on RHEL, where the old ran on Solaris.
Somehow, under Solaris, when piped logging was used, the scripts to which the log was piped ran as the same user as Apache, that being webservd. Under RHEL, however, they end up running as root, where I would have preferred that they run as the apache service account (i.e. apache, the same account where the actual Apahce services get spawned).
Solutions that involve using sudo in the pipe call aren't sufficient; before I'll be allowed to move this past QA, I'll need to come up with a way to make it so that you can't cause something to run as root by putting it into the Apache config files. I suspect that the solution involves granting the apache user some special priviliges (so that it can bind to ports 80/443) and then using that rather than root to start the service.
Any help would be greatly appreciated.
Addendum: A request was made that I show how the piped log is called.
This is the relevant line from the configuration file:
CustomLog "||/httpd/scripts/syslog.py" qradar
What ends up happening is that the script at /httpd/scripts/syslog.py ends up running as root. We need to make this not only not happen, but also not possible to do.