suEXEC and Alias with 1.3: bug or feature ?

[Olivier Cahagne <ol...@epita.fr>]

Hi,

I'd like to know if it's possible to use suEXEC with the Alias feature 
of Apache 1.3 (1.3.14 as of now).
I checked Apache source code (mainly suexec.c) but I am not an expert 
neither so I'd like a confirmation whether it's possible or not.

Here's the setup we've been running for 3 years now (and regularly 
updated with 1.2.x then 1.3.x):
Apache is compiled with suEXEC enabled to run CGI scripts with the user 
id it belongs to.
The server runs under user nobody.

If I setup an alias in Apache httpd.conf as :

Alias /foo /home/users/foo/www

Every page called from www.site.com/foo is loaded from /home/users/foo/www.

But every CGI script called from www.site.com/foo will run under user 
nobody, not under user foo.
This is strange because the same script called from www.site.com/~foo 
will run under user foo as expected (suEXEC running fine).
There does not seem to any reverse Alias thing.

I searched for a similar thing on Apache's mailing-list, deja.com and 
the bug reports but didn't find anything.
I already asked this in comp.infosystems.www.servers.unix but got no 
answer from an Apache developer:
http://x60.deja.com/%5BST_rn=ps%5D/getdoc.xp?AN=578244314
I preferred to talk about this here before submitting a "bug" report.

-- 
Olivier.Cahagne@epita.fr

Re: suEXEC and Alias with 1.3: bug or feature ?

[Thomas Wouters <th...@xs4all.net>]

On Wed, Oct 18, 2000 at 07:56:42PM +0200, Olivier Cahagne wrote:

> That's why I wonder whether it's a bug or a deliberate feature: why can't
> Apache guess the CGI is called from an Alias, resolve this Alias, see it's
> in fact a User, then call suEXEC ?

On a similar note, I would like to make suEXEC a lot more useful in several
other areas. Is this part of Apache still being worked on ? We want to use
it for our servers, which run about 7000 vritualhosts, and want each to run
the *global* scripts using the local names, and to reduce some of the severe
paranoia security checks. I already did some of this for 1.3.6, but we ended
up not using that particular patch, for a number of reasons. Should I just
work on this, or are there people out there working on suEXEC ?

(BTW, ObTopic, Oliver, consider using a Redirect rule instead. I sort-of
agree suexec should mind the Aliases, but a Redirect rule is more likely to
work ;)

I-can-code-too---really!-ly y'rs,
-- 
Thomas Wouters <th...@xs4all.net>

Hi! I'm a .signature virus! copy me into your .signature file to help me spread!

Re: suEXEC and Alias with 1.3: bug or feature ?

[Olivier Cahagne <ol...@epita.fr>]

Hi,

> >I'd like to know if it's possible to use suEXEC with the Alias feature
> >of Apache 1.3 (1.3.14 as of now).
>
> Not in the way you want to. It only runs CGIs under a different user
> id for /~user/ paths (UserDir) and for <VirtualHost>s that contain
> User and Group directives.

Well, then, it should be documented there's no reverse Alias mechanism, or
clearly stated in the documentation that this is not possible. :)

I'm running Apache with suEXEC with many (3000) users (students), the way it
runs with /~user/. Everything is working fine, /~user/ CGIs running with
user id and / CGIs running with user nobody (for e.g.).
But, for some reasons, I wanted some Alias for e.g. www.site.com/project
pointing to /~user/project/
I thought a CGI called from /project/foo.cgi would be running under the same
user as /~user/foo.cgi but it does not. It runs with nobody identity.

That's why I wonder whether it's a bug or a deliberate feature: why can't
Apache guess the CGI is called from an Alias, resolve this Alias, see it's
in fact a User, then call suEXEC ?

Regards,

Re: suEXEC and Alias with 1.3: bug or feature ?

[Tony Finch <do...@dotat.at>]

Olivier Cahagne <ol...@epita.fr> wrote:
>
>I'd like to know if it's possible to use suEXEC with the Alias feature 
>of Apache 1.3 (1.3.14 as of now).

Not in the way you want to. It only runs CGIs under a different user
id for /~user/ paths (UserDir) and for <VirtualHost>s that contain
User and Group directives.

Tony.
-- 
en oeccget g mtcaa    f.a.n.finch
v spdlkishrhtewe y    dot@dotat.at
eatp o v eiti i d.    fanf@covalent.net