PHP may be executing as a “privileged” group and user, which could be a serious security vulnerability

Question

I ran some security tests on a Ubuntu 12.04 Server, and I've got these warnings :

PHP may be executing as a "privileged" group, which could be a serious security vulnerability.
PHP may be executing as a "privileged" user, which could be a serious security vulnerability.

In /etc/apache2/envvars, I have this:

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

And all files in /var/www are having these user/group: www-data:www-data

Am I setting this correctly? What should I do to fix this problem?

Answer 1

The privileged user in this case is www-data. You see, PHP will run always with the www-data:www-data permissions, which can be detrimental if the environment is shared between many users / projects, since PHP can overwrite or modify any file that belongs to www-data, irrespective of the user who created the script.

Of course, this is not a problem if you are the only user creating PHP scripts on your machine, is it.

Also, the UID / GID of www-data might be below 100; since some policies grant special privileges to users with low UIDs, that may be a reason your software is complaining.

If you are worried, read this.