3 ms·
> Because on most Unix systems Apache httpd runs under the root user This hasn't been true for what, 10+ years? Apache runs as user www-data on Ubuntu/Debian a
by SEJeff 8y ago
> Because on most Unix systems Apache httpd runs under the root user
This hasn't been true for what, 10+ years? Apache runs as user www-data on Ubuntu/Debian and as user httpd on Redhat / SUSE based distributions.
You're entirely right, but this is a bit of embellishment on the part of the exploit author (even though it is serious!)
- icedchai 8y agoIt actually starts as root, then drops privileges / setuids to www-data.
- tyingq 8y ago"this is a bit of embellishment on the part of the exploit author" Apache is saying the same thing. "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, ...code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root)" https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211 https://httpd.apache.org/security/vulnerabilities_24.html#CV...
- mchristen 8y agoLots of people install from source and just sudo everything because that's all they know.
- tannhaeuser 8y agoThe vanilla APACHE_RUN_USER/_GROUP is daemon/daemon so they're fine. daemon and nobody are users that by definition have no permissions on the host.
- Vogtinator 8y agoIt runs as wwwrun on SUSE based distros.