<-
Apache > HTTP Server > Documentation > Version 2.4

suEXEC '

¹® 5 � 5±Ù ó°� �) ¹® � Âü� .

suEXEC ±â� 9� CGI SSI á±�� � �� � �) ID� ¤¸� �) ID� � � º¸ CGI SSI á±�� � � � �� � �) � �) � �

±â� �) � �) � ' CGI SSI á±�� ��� � � º¸ � $ ±×� suEXEC� �� � � � ¹® ÄÄ � � � º¸ � � setuid root á±�è°� � á±�� º¸ ¹® ¤¸� suEXEC� �) '� «< �

Âü

top

�

� � 9±×·ì� ¹® � �

¸Õ setuid setgid ±â� �% � � ü � �) � � ¸ð ¸÷ � � � suEXEC� ' ¤¸� � �) ¤¸� � �

�' � ÄÄ � º¸ ±âº» �� ´¸� �$ � ¬±� setuid/setgid ±âå°� �� � � º¸ ¹Ì � � � � � �

� ' suEXEC = ' � �) � � �� � º¥ �� suEXEC �( ¸ð =� Á¶,$� Á¶, � °ß =� �( � � � º¸% ±â ¸ð ÁÖ � ±â8 =� � 9¸ø ¹® � º¸ � º¸ á±� � ¸Å � =� � ´º¸±� 9±×·ì� °ø � ¤¸� suEXEC =� '� �% �

� °4 �'¹ü , 9±×·ì suEXEC� 9 ±âº»� � � ' ±â °á °á±¹ ´¸� � ÁÖ � ±â8, suEXEC� �4 suEXEC � � °ï ´¸� � � ¹æ suEXEC� � suEXEC ±â� �) � º¸ 1' ´¸� � °¶ ÁÖ � � ´º�� � � � °ú suEXEC� �) � ÁÖ � � � � � suEXEC� �) � 9±×·ì � ¹®4

' �) � �? ±×� ? " � !

top

suEXEC º¸ ¸ð /a>

suEXEC� ±¸1 � � � °¸� º¸ ¸ð� ¸Õ � � � suEXEC ¹« � �4 � � º¸ ¹« Á¶, � ' � �

suEXEC 9 � �� ö¸� setuid "wrapper" á±�� ±â� wrapper ´¸� � ÁÖ � ¤¸� userid� � � � CGI SSI á±�� HTTP 2 ¤¸� ö¸� � 2 ¤¸� 9 suEXEC wrapper� á±�� � á±�� � �) ±×·ì ID� °ø

±×ì¸� wrapper � °ú � ±°�� � � °á Á¶°Ç$ � � � � á±�� � � ±â � � � ´¸� "� � � ' ¼¸� °ú �

  1. wrapper� � �) � � �)8 ?

    wrapper� � �) � � � � �)8 �

  2. ·¸� � wrapper� � �?

    wrapper ·¸� � �< � 9 � �� �� wrapper� ·¸� � �'¸ø � � � °Å 9 suEXEC �� ¹® � ¬´

  3. �) � wrapper� � � � ?

    �) � wrapper� � � � ? � �) (9 �) )� �� �

  4. ' CGI SSI á±�� ' ³Ã�üÁ� �'�?

    ' CGI SSI á±�� '/'� °Å ·Â�! '..' �'�? �� �) ' CGI/SSI á±�� suEXEC ¹® root ( --with-suexec-docroot=DIR Âü ) � �

  5. ' �) � � �?

    ' �) � Á¸, �?

  6. ' ±×·ì� � �?

    ' ±×·ì Á¸, �?

  7. ' �) � superuser� �?

    suEXEC root� CGI/SSI �� � �

  8. ' userid� 5 ID � º¸ ?

    � 5 �) ID � � ' ±× CGI/SSI á±�� � userid 59� ' "� � � �

  9. ' ±×·ì superuser ±×·ì �?

    suEXEC root ±×·ì CGI/SSI á±�� � �

  10. ' groupid� 5 ID � º¸ ?

    � 5 ±×·ì ID � � ' ±× CGI/SSI á±�� � groupid 59� ' "� ±×·ì � �

  11. wrapper� ±°�� ' �) ±×·ì �?

    � á±�� setuid setgid � ' �) ±×·ì , ±×·ì ±Ù¸ñ� �) � �� ¸ð ±×·ì� 4±â

  12. CGI/SSI á±�� ¸® ¸® ó°� �?

    ¸® Á¸, ' ¤¸� � ´°�� ¸® ó°� ¤¸� ¸® Á¸, ' ¬´

  13. ¸® 9 ¹°�� �?

    � � �� 2 °æ 2 ¸® suEXEC ¹® root �? UserDir 2 °æ 2 ¸® suEXEC userdir� � (suEXEC � � Âü ) � �?

  14. ¤¸� ±¸ ¸® °±�� �?

    ¸® ¤¸� � � �4 � ' � � � �) ó°�

  15. ' CGI/SSI á±�� Á¸, �?

    Á¸, ©¸é �

  16. ¤¸� ±¸ ' CGI/SSI á±�� °±�� �?

    ±¸ CGI/SSI á±�� ó°� � '

  17. ' CGI/SSI �� setuid setgid� �?

    °¸� á±�� � UID/GID� ó°� � '

  18. ' �) /±×·ì á±�� �) /±×·ì� ��?

    �) � � � ?

  19. ·Ö$ °æ � 2 �?

    suEXEC (� ) � PATH� � , (� � ) °æ ¸ñ ´°� �� ¨±�� ·Ö$ °æ � �

  20. ±°�� ' CGI/SSI á±�� � �?

    ¬±� suEXEC� � ' CGI/SSI á±��

� suEXEC wrapper º¸ ¸ð� $ � � °Ý � CGI/SSI � � '�, º¸ � � � Á¶,$� ¸Å4

º¸ ¸ð� � � � ÁÖ ' suEXEC �< � º¸ � ' ¹® "� � Á¶, Âü

top

suEXEC ±¸1°ú �

� � �)

suEXEC ±¸ �

--enable-suexec
� ±âº»� � °Å � ' suEXEC ±â� � APACI� suEXEC� ¹ã4ä¸� --enable-suexec �8 --with-suexec-xxxxx � 5 �
--with-suexec-bin=PATH
suexec ¹ê � °æ º¸ � � � ±â °æ ±âº»� ¹«$¸é � �) � � /em> --with-suexec-bin=/usr/sbin/suexec
--with-suexec-caller=UID
º¸ 9� � �) �. á±�� � � �)
--with-suexec-userdir=DIR
suEXEC ±Ù � �) ¸® ¸® ' ¸® ¸ð � � �) suEXEC� � ��, ¸ð á±�� "� (� � � "*" ) "�( " UserDir � �) ¤¸� � � �4 UserDir � passwd � �) ¸® ¤¸�� suEXEC � ' ±âº»� "public_html"�
°¼$ �� �� ¤¸� UserDir �) ¤¸� ¸ð �� � � � �, � �� ¸® ¬±� � � ' ¼¸�, "~userdir" cgi 2 '
--with-suexec-docroot=DIR
9 DocumentRoot� � suEXEC� �) (UserDirs � ) � °ø� ±âº» ¸® --datadir � "/htdocs" � ¬´ � � /em> "--datadir=/home/apache"� ±¸1 ¤¸� suEXEC wrapper document root� "/home/apache/htdocs" ¸® �)
--with-suexec-uidmin=UID
suEXEC '�% �) 5 UID� �� � 500� 100 ±âº»� 100�
--with-suexec-gidmin=GID
suEXEC '�% ±×·ì 5 GID� �� � 100 �� � ±âº»�4
--with-suexec-logfile=FILE
¸ð suEXEC � � � (� �� ¸ñ � ) ±â á±� � ' ±âº»� á±� � � "suexec_log"� $ á±� ¸® (--logfiledir) 9
--with-suexec-safepath=PATH
CGI � � °Ü PATH °æ � ±âº»� "/usr/local/bin:/usr/bin:/bin"�

suEXEC wrapper� ÄÄ � � � �/strong>
--enable-suexec �< suEXEC ±â� �% � °æ make ¸÷4 � � suexec � � (9 � ) � ¸Å4
¸ð � ÄÄ � make install ¸÷4 � � ¹ê ¸® suexec --sbindir �< ' ¸® � ±âº» 9 "/usr/local/apache2/sbin/suexec"�
� °ú root � � ÁÖ wrapper� �) ID� � ±â4 � root� ¼¸�� setuserid � ¾x �

� & ±Ë
suEXEC wrapper � �) � ±¸ � --with-suexec-caller� ' � � �)8 � '�, � � suEXEC� �) � � � �4ì¸� � � Á¶ � �� �� " �� � � 9� � ±×·ì� suEXEC� � � �$ � �

� � � �� � � � � �:

User www
Group webgroup

suexec� "/usr/local/apache2/sbin/suexec" �$¸é, � � �

chgrp webgroup /usr/local/apache2/bin/suexec
chmod 4750 /usr/local/apache2/bin/suexec

±×ì¸� � 9� � ±×·ì� suEXEC wrapper� �

top

suEXEC � �/a>

9 --sbindir �< ' ¸® suexec � (±âº»� "/usr/local/apache2/sbin/suexec") ã 9� � ±¸1 suEXEC wrapper� ð°� � � �·error log) � � � Ãä

[notice] suEXEC mechanism enabled (wrapper: /path/to/suexec)

� $ � ¹®±¸� ¤¸� � ±â � wrapper á±�� ã ¸ø °Å , � � setuid root� � '� ¹® ¬´

ÿ suEXEC ±â� �) � � � 9 �� � Áâü¸�, 9� Á×4 � � �( HUP� USR1 ±× � � °å Ãæ '

suEXEC� �) ¤¸� suexec � � 9� Á×4 �4

top

suEXEC �) �/a>

CGI á±� 2 °æ SuexecUserGroup � �) °¼$ � 2 °Å mod_userdir 2 2¸® °æ0 � suEXEC wrapper� �

°¼$
suEXEC wrapper� �) �' ¹æ VirtualHost SuexecUserGroup � �) ¬´ � ÁÖ � �) ID ¤¸�� � � CGI ¸ð 2 ' User Group� � �� ¼¸� ÁÖ � userid� �)

�) �
mod_userdir 2 2¸® ¤¸� suEXEC wrapper� � 2 �) ¸® �� �) ID� CGI á±�� � ±â� ¤¸� �) ID� CGI� � � � ¬¸�� º¸ �/a> �� çÁ� � ±¸ � --with-suexec-userdir Âü

top

suEXEC ���/a>

suEXEC wrapper �� º¸ ¤·� --with-suexec-logfile �< ' � � wrapper� � � ±¸1 � �$¸é � ¸ø ' á±� � � error_log� � �

top

� � Á¶, °æ

ÁÖ ! � ' 9±×·ì �� ¹® ¹® 5 Âü

wrapper� � � � ��' � � suEXEC �( "��� º¸ � �� � ´º�� �

�% �  en� |  fr� |  ja� |  ko� |  tr�

top

Comments

Notice:
This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our mailing lists.