I'm running a grsecurity-enhanced kernel and I have enabled the Trusted Path Execution
restrictions [0].

What these restrictions do is prevent a user from executing files unless the file (and
the directory in which it is) is owned by itself (or root) and is not group- or
world-writable.

Unfortunately, I ran into a file which doesn't fit in that description:

  $ ls -l /var/www/francoiswiki/
  -rwsr-sr-x  1 francois francois  15K oct  7 18:19 ikiwiki.cgi*

  $ ls -ld /var/www/francoiswiki/
  drwxr-xr-x 91 francois francois 4,0K nov  6 18:51 /var/www/francoiswiki/

I can't really see an easy way to work around this, so I am filing this wishlist bug
in the hope that someone will have an idea on how to meet these conditions or will
have a better solution.

At the moment, I created a "tpeexempt" group and I put the apache user in it. This
works but also means that none of the TPE restrictions apply to Apache :(

Cheers,
Francois

[0] I enabled this feature using the following config variables:

  CONFIG_GRKERNSEC_TPE=y
  CONFIG_GRKERNSEC_TPE_ALL=y
  CONFIG_GRKERNSEC_TPE_INVERT=y
  CONFIG_GRKERNSEC_TPE_GID=1001

Note that 1001 is the "tpeexempt" group I created for the "www-data" user.

This is fundamentally incompatible with wanting Apache (www-data) to run CGI
scripts provided by another user (francois). You can have either this or TPE,
but not both.

If you don't want the user francois to be able to escalate privileges to
www-data (which is what TPE is trying to prevent), you could either
use mpm-itk to have an Apache child running as francois, or you could
use suexec as described at
<http://ikiwiki-hosting.branchable.com/security/privilege_escalation/>
(although TPE might block the latter too).

    S