suEXEC: cannot get docroot information

[Davide Giunchi <da...@libero.it>]

Hi.
I'm trying to configure suEXEC to allow run "safe" CGI to virtualhost.
Here it's my ./configure for apache-1.3.22:

--enable-suexec --suexec-caller=nobody --suexec-docroot=/web/htdocs 
--suexec-logfile=/web/logs/suexec.log --suexec-userdir=home 
--suexec-uidmin=100 --suexec-gidmin=100
(i've tryied even with --suexec-userdir=/web/htdocs/home)

and here it's my VirtualHost section of httpd.conf:

NameVirtualHost *

<VirtualHost *>
    User test
    Group test
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /web/htdocs/home/pippo/html
    ScriptAlias /cgi-bin/ "/web/htdocs/home/pippo/cgi-bin/"
    ServerName www.example.com
</VirtualHost>

<VirtualHost *>
    User test
    Group test
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /web/htdocs/home/pippo2/html
    ScriptAlias /cgi-bin/ "/web/htdocs/home/pippo2/cgi-bin/"
    ServerName www.example2.com
</VirtualHost>


I would like that a CGI run by www.example2.com cannot read the documents of 
www.example.com but i can't define a different user for every virtualhost 
(because this is a test, i will run vhost_alias at the end).

The permission of /web/htdocs/home (where all virtualhost reside) are:

bash# ls -al /web/htdocs/home/
total 16
drwxr-xr-x    4 root     root         4096 May 13 12:56 .
drwxr-xr-x   15 root     root         4096 May 13 12:56 ..
drwxrwx---   16 nobody   nobody       4096 May 14 09:31 pippo
drwxrwx---    4 nobody   nobody       4096 May 14 09:31 pippo2
bash#

So apache can access it but "test" user can't (i made this to make it 
unaccessible to other domains).
Now if i try to execute a CGI of www.example2.com i get error 500 and this 
entry in suexec.log:
emerg: cannot get docroot information (/web/htdocs)

If i do a
# chmod 555 /web/htdocs/home/pippo2
The cgi is executed correctly but other domains can see my (www.example2.com) 
documents!

So what can i do to make users execute their CGI normally but without the 
permission to read other user's documents?

Any help or advice will be appreciated.

Regards.
-- 
Davide Giunchi.
Membro del FoLUG (Forlí Linux User Group) - http://folug.linux.it
GPG Key available on http://www.keyserver.net 
Fingerprint: 8075 363A B4FA 0196 FEEC  AF9C 19A9 66C7 CDAB D0D5

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org