How to disable access to parent directory of DocumentRoot?

Question

I have an Ubuntu system hosting several websites. The DocumentRoot folder of each website is separate and has a different user. The paths are like this:

/<path_from_root>/websites/websiteA
/<path_from_root>/websites/websiteB

Let's assume that the respective users are userA and userB. Though, the userB doesn't have read access to the folder websiteA, the apache user does have the access. userB can simply write a php file like this in his directory:

<?php
$x=file_get_contents('../websiteA/config.php');
echo $x;
?>

This file will expose the config.php file to the userB. The key issue is that apache needs to have read access to both the folders for running the web services but the userB can exploit this to access userA's files. How to prevent this from happening?

There should be a configuration option for each `` telling it which user to run it under if I recall correctly. — SeinopSys, Apr 28 '15 at 09:21
The [documentation of apache](http://httpd.apache.org/docs/2.2/mod/core.html#virtualhost) doesn't mention any such option. — agamagarwal, Apr 28 '15 at 09:24

score 2 · Answer 1 · edited May 23 '17 at 12:32

2

You can use the php directive open_basedir in your apache or vhost config files for individual settings.

<VirtualHost *:80>
    <Directory /docroot>
        php_admin_value open_basedir /docroot 
    </Directory>
<VirtualHost>

so scripts within this path can not open files outside of it.

edited May 23 '17 at 12:32

Community

1
1

answered Apr 13 '17 at 10:23

Jango Brain

63
9

Thanks, just what i needed! – Viktor Koncsek Sep 13 '17 at 10:40
saves my day tvm – josevoid Dec 05 '19 at 06:57

score 0 · Answer 2 · answered Apr 28 '15 at 11:29

You might want to look into how Apache and PHP are connected on your machine. If you use the Apache module mod_php, as far as I know all PHP code is executed as the user Apache itself runs as. If you connect PHP with CGI (fcgi, fastcgi or something from that range), you can use suEXEC. With suEXEC, you can set the user that PHP should run as per virtual host.

How to disable access to parent directory of DocumentRoot?

2 Answers2