Bug#654545: apache2-suexec: some possible security improvements for suexec/suexec-custom
Package: apache2-suexec
Severity: normal
Hi.
Currently suexec is compiled with:
-D AP_GID_MIN=100
-D AP_UID_MIN=100
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
Some things that are perhaps worth to think about:
1) Is there a specific security reason not to include /sbin and /usr/sbin ?
I mean any CGI script can just manually call any binary in there.
Is it just to avoid accidental invocations of stuff in there?
And admittedly,.. most CGI-scripts should have probably no need for programs
from there.
2) /usr/local/bin
In Debian this is writable by members from the staff group.
Of course,... if root adds any user to this group he should know what he does.
But perhaps it would make also sense to drop it?
If a script really needs it, it can still just use the full path.
3) minimal UID and GID
In Debian the UIDs/GIDs are classified as follows:
http://www.debian.org/doc/debian-policy/ch-opersys.html#s9.2.2
It would probably break many setups,.. but perhaps it's worth thinkg about
increasing this to 1000.
Otherwise suexec can su to most system daemons...
OTO I'm of course well aware that this is in many cases what's wanted.
Have a look at bug #654543 for a possible even better solution (at least for suexec
-custom).
Cheers,
Chris.
Reply to: