note 2023 deleted from Apache module by ronabop

This really bugs me. I want a solution. Here is a proposal, but it involves some kernel hacking which I'm not qualified for. What we really need is for php to be able to change the user id of its process to the owner of the script. The problem as I understand it is that UNIX does not provide a way for a process to change its user ID, apart from switching between two preset IDs that need to be set up by a root owned process. This is for obvious security reasons :). The answer is to create a special user ID (lets say 10), and have the http daemons run with an effective user ID of 'nobody' and an actuall user ID set to 10. Any process that has an user ID of 10 is allowed to change the effective user ID to any ID at all. This would now allow the http server to execute CGI scripts and automatically honour suid bits without using a cgi-wrapper. It would also allow php to switch the process owner to the owner of the script it is executing. Ahah! I hear you say... we now have a major security problem. Indeed we do, because any process spawned by a suid php or cgi script will now also have a real user id of 10 and thus be able to switch to any user, resulting in a very serious security problem. We can close this however. The final piece of my proposed solution is that when the kernel forks a new process, it checks to see if the real user ID is 10. If it is, it changes the real ID to be the same as the effective ID - thus this sepcial dispensation can only be given by a root owned process, but can not be passed on to child processes. This is secure because it is OK for root to set the real user id to 10 for an executable it trusts. By doing so, it gives the http server the ability to change its user identity (which is the fundemental problem we really need to solve here), but it will not let any spawned process inherit this ability. Anyone care to try this out, or help me to? Anyone see a flaw in my plan? -Dino