On 17 Apr 2008, at 00:06, A.D.F. wrote: > Stefan de Konink wrote: >> >> I wonder if someone can reproduce this problem: >> >> Make a file: >> >> echo "Cherokee... don't be so naughty" > test.html >> chmod 000 test.html >> >> ...access the file with cherokee; I expect this is not 'by design'. > > If you are root, then you have no limits ... > and yes, this is by design ... > > OK, if user is root, then readability has to be verified > explicitely before opening the file.
In my understanding, file system access permission checks belongs to the operating system. Running a program as root user implies a number of things: it can open a low port, it can jail itself, it can change system limits, AND it can read every file in the system. That is how Unix systems work. That's why Cherokee supports user changing, and all the modern operating systems include a 'web server user' such as www-data, httpd or www. > Indeed here some parametric policy could be added, > i.e. access only files readable by world, by group, by user. I'm not sure of this at all. Running servers as root is highly discouraged because of this kind of problems. By adding those rules we would be duplicating a work that the underling operating system will perform anyway, which means, the server would be slower and the only thing that we would get is to slightly improve the behavior of the server under a certain -let's call it- "misconfiguration"; or at least: 'not recommended' configuration. IMO the best thing we could do is to warn the user if the server runs as root. Maybe cherokee-admin could pop a red, flashy warning message if the server is configured to run as root. So, even if it is tougher I would try to educate people rather than "fix" Cherokee for hiding some of the potential problems of running a server as super-user. -- Greetings, alo. _______________________________________________ Cherokee mailing list [email protected] http://cherokee-project.com/cgi-bin/mailman/listinfo/cherokee
