Web Security and Commerce

Tips on Writing CGI Scripts That Run with Additional Privileges

Many CGI scripts need to run with user permissions different from those of the web server itself. On a UNIX computer, the easiest way to do this is to make the CGI script SUID or SGID. By doing this, the script runs with the permissions of the owner of the file, rather than the web server itself. On Mac, DOS, and Windows 95 systems, there is no such choice—scripts run with the same privileges, and can access everything on the system.

Unfortunately, programs that run with additional privileges traditionally have been a source of security problems. The list of suggestions below is based on that list and is specially tailored for the problems faced by the web developer:

1. Avoid using the superuser (SUID root or SGID wheel) unless it is vital that your program perform actions that can only be performed by the superuser. For example, you will need to use SUID root if you want your CGI program to modify system databases such as /etc/passwd. But if you merely wish to have the CGI program access a restricted database of your own creation, create a special UNIX user for that application and have your scripts SUID to that user.

2. If your program needs to perform some functions as superuser, but generally does not require SUID permissions, consider putting the SUID part in a different program, and constructing a carefully controlled and monitored interface between the two.

3. If you need SUID or SGID permissions, use them for their intended ...