A.P. Lawrence

2005/05/12 suexec

-r-s--x---  2 root apache 18832 Jan 28 01:31 /usr/sbin/suexec

This is an Apache helper program. Its purpose is to allow a web site to let individual users execute cgi-bin programs for their sub-site without jeopardizing the security of other users. As you can see above, it is set-uid root, but can only be executed by the apache group. There's more to it though: the binary has been compiled with the apache username specified and it will ONLY work when the user apache is the caller.

It has to be setuid root so that it can in turn assume the ordinary user's id while executing the cgi script. What we have is Apache, not running as root, using this setuid binary to become root just long enough to become the user who's script is about to be executed. That means that the ultimate cgi script can only do things that the individual user could do anyway - it's not running as root or as apache.

But a setuid script owned by root could be dangerous. If anyone could run suexec, anyone could do anything they like. You'd have no security at all. So the apache id is compiled in, and it checks itself against that. It also checks that it has been properly invoked, which is something the man page doesn't tell you how to do. The docs explain:

 The wrapper will only execute if it is given the proper number of
 arguments. The proper argument format is known to the Apache web
 server. If the wrapper is not receiving the proper number of
 arguments, it is either being hacked, or there is something wrong
 with the suEXEC portion of your Apache binary.

And there are more checks. The binary itself does all the checking it can to avoid being a tool which someone could use to thwart the intended security.

Apparently earlier versions had some Pam support, but it looks like that has been removed: http://lists.debian.org/debian-apache/2004/08/msg00386.html.

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here