From: Alan Chen <alan@...>
Date: 2002-01-27T13:48:25+09:00
Subject: Re: Eruby with different uid

I just checked it out on my system, you can run eruby pages as cgi scripts
by putting the standard shebang on the first line of the file.  Here's what
I tried: (And it worked on the command line)

#!/usr/bin/eruby
<html>
  <head>
  </head>
  <body>
    <h1>Hello World</h1>
  </body>
</html>

Running this as a script returned the html page as normal.
Based on this, I believe you should be able to treat eruby scripts
the same way you're securing the other cgi scripts on your system.

-- alan

On Sun, Jan 27, 2002 at 04:53:16AM +0900, Devin Bayer wrote:
> Hi.  I am trying to setup a free public webserver where users can use 
> arbitrary CGI and eruby scripts.  It's using Apache on Linux.  By 
> default all scripts run as user 'www-data'.  This means one user could 
> alter the files of another user because they are all owned by the same 
> person.  For CGI scripts I setup SuExec to use the corresponding UID for 
>  user's scripts.
> 
> What can I do for eruby?  I want all scripts to be run with an effective 
> uid that is equal whomever's home dir contains the script.  If it could 
> do all the same security checks as SuExec that would be nice, but not 
> required.
> 
> 
> 
> Does anyone have any suggestions or pointers.  Or maybe another way for 
> users to each have their own CGI/eruby scripts that can't interfere.
> 
> --
> Devin Bayer
> 

-- 
Alan Chen
Digikata LLC
http://digikata.com