Recommended setting for using Apache mod_mono with a different user
- by Korrupzion
Hello,
I'm setting up an ASP.net script in my linux machine using mod_mono.
The script spawn procceses of a bin that belongs to another user, but the proccess is spawned by www-data because apache runs with that user, and i need to spawn the proccess with the user that owns the file.
I tried setuid bit but it doesn't make any effect. I discovered that if I kill mod-mono-server2.exe and I run it with the user that I need, everything works right, but I want to know the proper way to do this, because after a while apache runs mod-mono-server2.exe as www-data again.
Mono-Project webpage says:
How can I Run mod-mono-server as a different user?
Due to apache's design, there is no
straightforward way to start processes
from inside of a apache child as a
specific user. Apache's SuExec wrapper
is targeting CGI and is useless for
modules.
Mod_mono provides the MonoStartXSP
option. You can set it to "False" and
start mod-mono-server manually as the
specific user. Some tinkering with the
Unix socket's permissions might be
necessary, unless MonoListenPort is
used, which turns on TCP between
mod_mono and mod-mono-server.
Another (very risky) way: use a setuid
'root' wrapper for the mono
executable, inspired by the sources of
Apache's SuExec.
I want to know how to use the setuid wrapper, because I tried adding the setuid to 'mono' bin and changing the owner to the user that I want, but that made mono crash. Or maybe a way to keep running mono-mod-server2.exe separated from apache without being closed (anyone has a script?)
My environment:
Debian Lenny 2.6.26-2-amd64
Mono 1.9.1
mod_mono from debian repository
Dedicated server (root access and stuff)
Using apache vhosts
-I use mono for only that script
Thanks!
