Hi,
I have a quiestion regarding mod_ruby security, hope someone might help me out.
Suppose, I have a local user on my server, who has a chroot jail, scponly web-home folder to upload .rhtml (or .rb) files, that apache executes by mod_ruby. At the default safe level (=1) he can execute code like:
% expr = %{File.read(\"/etc/postfix/main.cf\")}
% result = eval(expr)
% puts result
She can see globally readable files on the server while his code is running in the name of the apache user. The same happens with "RubySafeLevel 2". With 3 or 4, the user cannot access these files, but actually he cannot do anything reasonable at all, so that is not really an option. My question is, can I do something similar to PHP-s safe_mode, where the running _code_ is jailed into its folder somehow? Or any other solution?
Thx in advance!
PSz
p.s: changing acces rights of all files is s.g. I don't want to do (fighting debian file acc.rights policy on hundreds of files) that's why I like scponly/jailroot
ยทยทยท
--
Parragh Szabolcs
e-mail: parragh@dayka.hu
web: parszab.nir.hu