4 ms·
Outside of any executable location, not only DocumentRoot. Latter is just an easier and more popular target. I mean, all writeable directories (if any) must no
by drdaeman 13y ago
Outside of any executable location, not only DocumentRoot. Latter is just an easier and more popular target.
I mean, all writeable directories (if any) must not only be not runnable by some server (like Apache with mod_php), but also be on devices mounted with noexec, like this is the case with /tmp.
- jlgaddis 13y agoI'm not sure that'll help like you think it will. I can't verify it at the moment, but create a /tmp/phpinfo.php file with "<?php phpinfo(); ?>" in it and then run "php /tmp/phpinfo.php". Regardless of whether /tmp is mounted noexec I think you'll find that it executes (because the php binary is under /usr which almost certainly isn't mounted noexec).
- drdaeman 13y agoWhoops, seems that you're right, I was wrong about interpreters taking noexec into account - either I misremembered something or things changed, but the fact is they don't. Sorry. Anyway, it's also better to have noexec than not. :) At least, it'll help if there's no complete shell access but only ability to run some binary by name, without args, or modify environment variables when running some executable.