Home/ Questions/Q 994213
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T06:32:33+00:00

I have written a Linux system wide C++ program /usr/bin/PROG_X that uses a configuration

  • 0

I have written a Linux system wide C++ program /usr/bin/PROG_X that uses a configuration file /etc/PROG_X.conf and log file /var/PROG_X.log.

Now I need to call this program, after strong authentication, from the web using apache web server and php. Calling the program may involve changing configuration files and will change, of course, log files.

I am interested in keeping SELinux enabled.

My Querstion is: What user/group and what file permissions should be set for the binary file, configuration files and log files for proper and secure operation?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    For the most locked-down approach (assuming the log and config are sensitive):

    Apache runs as user ‘www’, ‘progx’ user and group exists for the sole purpose of running /usr/bin/PROG_X.

    /etc/PROG_X.conf is owned by root:progx, and has permissions 640
    /var/PROG_X.log is owned by root:progx, and has permissions 660
    /usr/bin/PROG_X is owned by progx:progx, and has permissions 500
    /etc/sudoers allows www to run only /usr/bin/PROG_X as progx.

    Thus, only root and progx can see the config or read/write the log file, and only root can modify the config. Only progx can run the program, but apache can specifically launch your program as progx via sudo.

    [Edit: missed the part that said the program may need to change its config file… so the permissions would be 660 instead]

    • 0