|Was the wrapper called with the proper number of arguments?
||The wrapper will only execute if it is given the proper number of arguments. The
proper argument format is known to the Apache web server. If the wrapper is not receiving
the proper number of arguments, it is either being hacked, or there is something wrong with
the suEXEC portion of your Apache binary.
|Is the user executing this wrapper a valid user of this system?
||This is to ensure that the user executing the wrapper is truly a user of the system.
|Is this valid user allowed to run the wrapper?
||Is this user the user allowed to run this wrapper? Only one user (the Apache user) is
allowed to execute this program.
|Does the target program have an unsafe hierarchical reference?
||Does the target program contain a leading '/' or have a '..' backreference? These are
not allowed; the target program must reside within the Apache webspace.
|Is the target user name valid?
||Does the target user exist?
|Is the target group name valid?
||Does the target group exist?
|Is the target user NOT superuser?
||Presently, suEXEC does not allow 'root' to execute CGI/SSI programs.
|Is the target userid ABOVE the minimum ID number?
||The minimum user ID number is specified during configuration. This allows you to set
the lowest possible userid that will be allowed to execute CGI/SSI programs. This is
useful to block out "system" accounts.
|Is the target group NOT the superuser group?
||Presently, suEXEC does not allow the 'root' group to execute CGI/SSI programs.
|Is the target groupid ABOVE the minimum ID number?
||The minimum group ID number is specified during configuration. This allows you to set
the lowest possible groupid that will be allowed to execute CGI/SSI programs. This is
useful to block out "system" groups.
|Can the wrapper successfully become the target user and group?
||Here is where the program becomes the target user and group via setuid and setgid
calls. The group access list is also initialized with all of the groups of which the
user is a member.
|Does the directory in which the program resides exist?
||If it doesn't exist, it can't very well contain files.
|Is the directory within the Apache webspace?
||If the request is for a regular portion of the server, is the requested directory
within the server's document root? If the request is for a UserDir, is the requested
directory within the user's document root?
|Is the directory NOT writable by anyone else?
||We don't want to open up the directory to others; only the owner user may be able
to alter this directories contents.
|Does the target program exist?
||If it doesn't exists, it can't very well be executed.
|Is the target program NOT writable by anyone else?
||We don't want to give anyone other than the owner the ability to change the program.
|Is the target program NOT setuid or setgid?
||We do not want to execute programs that will then change our UID/GID again.
|Is the target user/group the same as the program's user/group?
||Is the user the owner of the file?
|Can we successfully clean the process environment to ensure safe operations?
||suEXEC cleans the process' environment by establishing a safe execution PATH (defined
during configuration), as well as only passing through those variables whose names are
listed in the safe environment list (also created during configuration).
|Can we successfully become the target program and execute?
||Here is where suEXEC ends and the target program begins.