Hi, I am following up on Debian bug report #586092:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=586092
/var/log/cherokee/* is readable by www-data writeable by
www-data. User www-data should not have this access.
And quickly verifying... Yes, Cherokee opens the log file after
dropping root privileges. Possibly it would be sensible for Cherokee
to open the logs before dropping privileges? (although that it could
be more dangerous, as Cherokee could be tricked, say, via a simple
symlink "attack" to write to the wrong file).
What do you think on this user request? Frankly, having the Web user
not able to modify the webserver's log (i.e. to erase his own tracks
after attacking the server) sounds like a good thing.
Thanks,
signature.asc
Description: Digital signature
_______________________________________________ Cherokee mailing list [email protected] http://lists.octality.com/listinfo/cherokee
