restricting filesystem rights to apache/php for anything but logging operations

Question

Hello and merry Christmas,

I've got a wonder. My need is to allow the creation of custom log files and folders through php, however I don't want the php script to be able to execute any unlink or harmful operation on my unix server.

It is important to know that the users may use custom php script that's why I have to prevent at maximum harmful operations, BUT the one of creating log files.

Do you know whether this could be accomplished with Apache 2 under centOs6?

Thank you for your support, S.

Answer 1

You could use php's open_basedir setting to restrict them to a dedicated directory to create and modify log files in. In addition, you would want to configure apache to not serve/execute any files in that directory, because they may write executable files.

You still need to worry about disabling other functions like exec() to prevent them from running system commands, because open_basedir is a purely php enforced concept which doesn't affect the rest of the server via the filesystem permission system.

the "or harmful operation on my unix server" is the hard part. You might want to consider setting up a VM to give them a robust jailed environment.