1

I know this is one of the stupidest ideas you have heard of but my client, as part of his thesis project, he wants to be able to stream any media, including media on external hard disk.

proxying is an option but we finished the script and he just wants to change the document root to / after all this is just a university project.

In windows, we were able to change the document root to C: and it worked, ubuntu, no luck setting it to / so how to let apache run on all the machine/

7
  • 2
    With FollowSymLinks you should be able to do what you need to, without it being 'stupid'.
    – user508889
    Jun 7, 2016 at 18:56
  • FWIW, nginx has absolutely no problems using / as root.
    – muru
    Jun 7, 2016 at 21:10
  • Not sure, but wouldn't anyone be able to view any file? Even sensitive ones like /etc/shadow?
    – user423626
    Jun 7, 2016 at 21:54
  • @bc2946088 could you elaborate or post an answer?
    – Lynob
    Jun 8, 2016 at 11:46
  • @muru will give it a try
    – Lynob
    Jun 8, 2016 at 11:47

3 Answers 3

7

I know this is one of the stupidest ideas you have heard of but my client.

It is.

And you can't with a normal install. Apache would be needed to be run as "root" and Apache has a built-in security check on it. Error notice you will see...

Apache has not been designed to serve pages while running as root. There are known race conditions that will allow any local user to read any file on the system. If you still desire to serve pages as root then add -DBIG_SECURITY_HOLE to the CFLAGS env variable and then rebuild the server. It is strongly suggested that you instead modify the User directive in your httpd.conf file to list a non-root user.

So to do what you want to do you need to ...

  1. add -DBIG_SECURITY_HOLE to the CFLAGS env variable.
  2. rebuild apache server.
  3. setup http.conf with root as the user.

I will leave it up to you on how to do this and would suggest you to forget about this, use a normal (restricted) user as intended and store files in a sub-directory owned by that user.

5
  • What about proxy the php script would it work?
    – Lynob
    Jun 7, 2016 at 18:25
  • @Lynob No, you have the same problem with permissions with PHP as you would with Apache, and I don't think it sanely runs either if you try and force it to have god permisisons.
    – Thomas Ward
    Jun 7, 2016 at 18:59
  • @Lynob no, php wont let you abuse the permissions.
    – Rinzwind
    Jun 7, 2016 at 19:06
  • +1 for "it is". But is this a large security hole? Www-data doesn't have so much permission
    – Motte001
    Jun 7, 2016 at 19:56
  • sure but www-data can not write in /. but apache using / is.
    – Rinzwind
    Jun 7, 2016 at 20:13
4

You can accomplish a bit of what you might want with FollowSymLinks and the correct permissions on files.

This method will only create links to data where you specify, it will not give you the entire filesystem, unless you were to create symlinks for every path of course, and even then, you might run into problems with specific system paths.

By default Apache2 has FollowSymLinks on by default, so no additional apache configuration was needed. For the sake of answering this question, I spun up an openstack instance, and did the follow steps.

I will mention, I would have assumed more would be needed as far as setting permissions, actually kind of scary.

Maybe root having a running instance of apache2 makes it work? I don't think www-data would have access to /home/ubuntu by default. Strange.

ubuntu@test:/home/ubuntu# sudo su
root@test:/home/ubuntu# apt-get install apache2
root@test:/home/ubuntu# ps awux | grep apache2
root     30862  0.0  0.1  71300  2572 ?        Ss   12:17   0:00 /usr/sbin/apache2 -k start
www-data 30865  0.0  0.2 360464  4252 ?        Sl   12:17   0:00 /usr/sbin/apache2 -k start
www-data 30866  0.0  0.2 557344  5024 ?        Sl   12:17   0:00 /usr/sbin/apache2 -k start
root@test:/home/ubuntu# cd /var/www/html/
root@test:/var/www/html# ls
index.html
root@test:/var/www/html# ln -s /tmp tmp-symlink
index.html  tmp-symlink
root@test:/var/www/html# cd tmp-symlink
root@test:/var/www/html/tmp-symlink# ls
hsperfdata_ubuntu
root@test:/var/www/html# ln -s /home/ubuntu/ ubuntu-user
root@test:/var/www/html# cd /home/ubuntu/
root@test:/home/ubuntu# ls
file  test  test_directory  test.sh

tmp-symlink screenshot


ubuntu-user screenshot

3
  • Actually, I was able to symlink / and have full access to the file system. That doesn't seem right, ha.
    – user508889
    Jun 8, 2016 at 12:39
  • symbolic link wont work in my case because im trying to feed the media to jquery players, it won't play them, just tried
    – Lynob
    Jun 8, 2016 at 13:42
  • I'm not following... your link should look the same if the symlink is named the same as the path. for example /mnt -> /mnt would still show in the url as /mnt/path/to/media.mpeg
    – user508889
    Jun 8, 2016 at 14:18
-1

First of all here is my solution which can work with apache2-2.4.10 (as a result, you will have to replace it by the version which is in your software sources).

apt-get -y install dpkg-dev debhelper libaprutil1-dev libapr1-dev libpcre3-dev liblua5.1-0-dev autotools-dev
apt-get source apache2.2-common
cd apache2-2.4.10
export DEB_CFLAGS_SET="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DBIG_SECURITY_HOLE"
dpkg-buildpackage -b
cd ..
dpkg -i "name of the package apache2-bin* you generated with dpkg-buildpackage -b"
dpkg -i "name of the package apache2-common* you generated with dpkg-buildpackage -b"

Then modify httpd.conf or /etc/apache2/envvars file to set root instead of www-data (you can search www-data string and replace it by root) and restart apache.

Secondly here is the explanation:

  1. Installed dependencies to use dpkg-buildpackage and dpkg
  2. Got the source from the repository
  3. Modified environment variables CFLAGS used by dpkg-buildpackage and added -DBIG_SECURITY_HOLE to it
  4. Navigated to the apache generated directory and ran dbkg-buildpackage to recompile the package with the modified CFLAGS
  5. Returned in the parent directory to use the generated packages
  6. I install the packages apache2-bin and apache2-common

    sudo apt-get install apache2-bin apache2-common
    
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .