Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran some security tests on a Ubuntu 12.04 Server, and I've got these warnings :

PHP may be executing as a "privileged" group, which could be a serious security vulnerability.
PHP may be executing as a "privileged" user, which could be a serious security vulnerability.

In /etc/apache2/envvars, I have this:

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

And all files in /var/www are having these user/group: www-data:www-data

Am I setting this correctly? What should I do to fix this problem?

share|improve this question

The privileged user in this case is www-data. You see, PHP will run always with the www-data:www-data permissions, which can be detrimental if the environment is shared between many users / projects, since PHP can overwrite or modify any file that belongs to www-data, irrespective of the user who created the script.

Of course, this is not a problem if you are the only user creating PHP scripts on your machine, is it.

Also, the UID / GID of www-data might be below 100; since some policies grant special privileges to users with low UIDs, that may be a reason your software is complaining.

If you are worried, read this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.