Let's say I have a website under www.example.com
and would like to also have a blog under a subfolder, e.g. www.example.com/blog/
. How can I sandbox this folder, so that any script running inside it, won't be able to touch any files outside of it?
Edit: Added info below.
The current configuration uses Apache with Suexec and php-fastcgi:
<VirtualHost X.X.X.X:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /home/example/public_html
ScriptAlias /cgi-bin/ /home/example/cgi-bin/
DirectoryIndex index.html index.htm index.php
RemoveHandler .php
php_admin_value engine Off
IPCCommTimeout 301
FcgidMaxRequestLen 1073741824
SuexecUserGroup "#1000" "#1000"
<Directory /home/example/public_html>
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
AddType application/x-httpd-php .php
AddHandler fcgid-script .php
FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php
</Directory>
<Directory /home/example/cgi-bin>
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
</Directory>
</VirtualHost>
/home/example/fcgi-bin/php5.fcgi contains:
#!/bin/bash
PHPRC=$PWD/../etc/php5
export PHPRC
umask 022
export PHP_FCGI_CHILDREN
PHP_FCGI_MAX_REQUESTS=99999
export PHP_FCGI_MAX_REQUESTS
SCRIPT_FILENAME=$PATH_TRANSLATED
export SCRIPT_FILENAME
exec /usr/bin/php5-cgi
From what I know, the SuexecUserGroup
can be used only in the server config or virtualhost context, so it cannot be specified in a directory context. What options do I have?