Question

I know that CGI programs sometimes run as the Apache user. I also know that for a CGI program to write to a data file, you can make the file world-writable. However, this means it can be written to (or even deleted) by other users who have a logon to the server or an attacker could install their own CGI programs there.

What I am asking is there a more secure way to allow a script to write to a file?

Answer 1

The rationale: separate CGI folders and Data folders

Usually, cgi scripts are stored in a separate folder (usually cgi) that is not world-writable. Only privileged users (who are supposed to create the cgi scripts) have write-access to this folder.

Other files are stored another folder, where permissions are more lenient.
Making it world-writable isn’t a great idea either, though. Only the user(s) with a reason to access the folder should be able to access it.

---

Marking folders as containg CGI scripts in Apache:

ScriptAlias

The ScriptAlias directive allows Apache to know whether a given folder is meant to contain cgi scripts that should be executed:

ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/

Would let Apache execute all files in those folders, expecting those to be cgi files.

ExecCGI

You can give Apache permission to execute cgi scripts in a specific folder using the ExecCGI Option:

<Directory /usr/local/apache2/htdocs/somedir>
    Options +ExecCGI
</Directory>

You will then also need to indicate how a cgi script can be differentiated from another file, which is done using the AddHandler Directive. Using:

AddHandler cgi-script .cgi

Would indicate that cgi scripts have the extension .cgi

More info

You should have a look at the Apache documentation regarding CGI script execution.