Apache permission problem

[Armitage]

I have a CGI script that generates a png image in the /tmp diorectory. But the apache server can't see it with either an absolute path, or a path relative to the document root. And the script can't write to anything in the document root.

Any suggestion? I suspect it's a Bad Idea to make the document root writable by Apache.

 

[kamper]

How are you trying to access it from apache? If you mean via request url, it'd be a huge security issue if you could get at things outside the docroot.

You could make a particular directory within the docroot writeable by the cgi script. It's not ideal, but sometimes you've got to do it. I mean, are you sure that there's nowhere else on the filesystem that apache can write anyways? (This is why I like the nice default chroot on openbsd, it's super-easy to audit what apache can access 🙂). Obviously it can write to /tmp anyway, which is probably worse than in the docroot because the docroot can be on its own slice/partition (for filling up the filesystem or setting noexec and such).