what user does PHP go as?

ShawnD

does PHP write as root? i'm asking because i start my webserver as root and it's the webserver that calls on PHP........

i'm asking for a security reason. in the case that i did some VERY bad programming such as allowing users to choose the name of the file to save as and they entered something like ../../etc/passwd (/var/www/../../etc/passwd lists all users, home directories and default shells)
now if php runs as the user php or some other non-superuser, it would not be able to write but if it runs as root i would be fudged.

piersk

Doesnt it run as user the "nobody" like the webserver does?

ShawnD

now wait a minute, how can PHP run as nobody but it can save files when the website root is chmoded to 755 and the owner is shawnd? 755 means only the owner (shawnd) can write to those files but PHP and Perl can write to them with no problems.

i'm getting scared 🙁 lol

piersk

Then that would lead me to believe that, yes PHP does have root access. Id change this asap, if not sooner...

jmcneese

if you start your webserver as root, PHP will create files as root. i recommend starting your webserver daemon as 'nobody' or 'httpd', and adjusting your docroot permissions accordingly.

ShawnD

ok i changed the port to 8080 so i could actually run it as non root and now the server is completely screwed, look at this:
http://shawnserver.d2g.com says the connection was actively refused
you have to type the address as
http://shawnserver.d2g.com:8080

edit:
i changed it back to port 80 so these links no longer work, i'll keep them up just so you can see the situation.

edit:
it says this WORD FOR WORD in the httpd.conf file:
for ports < 1023, you will need httpd to be run as root initialy.

yelvington

it says this WORD FOR WORD in the httpd.conf file:
for ports < 1023, you will need httpd to be run as root initialy.

Read the Apache docs and read the rest of httpd.conf.

If you wish httpd to run as a different user or group, you must run

httpd as root initially and it will switch.

User/Group: The name (or #number) of the user/group to run httpd as.

On SCO (ODT 3) use User nouser and Group nogroup

On HPUX you may not be able to use shared memory as nobody, and the

suggested workaround is to create a user www and use that user.

NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET)

when the value of (unsigned)Group is above 60000;

don't use Group nobody on these systems!

User nobody

undertow

I just created a user and group called "apache" to run Apache as and only gave it ownership to one folder where PHP could write any files it needs to. You need this sort of thing for web applications like SquirrelMail that need to write to files for them to work.

I don't know how the "nobody" user works so I didn't use it.