user writing files as apache and apache acls

Hi,
I see some previous mentions of this on the list, with regard to group 
membership - www-data etc. The issue I'm seeing is similar.

On Fedora Core 4, using the normal RedHat mechanism to create users, 
whereby each user created belongs to a group of the same name, and the 
webserver runs as 'apache'.

On a shared hosting server, where sites are located in 
/var/www/sites/www.* to keep users from snooping into each other's home 
directories, but to allow apache to read the dirs, I've done this:

# keep users from viewing other's files
chmod 751 /var/www/sites/www*

# allow apache to read all dirs and files.
setfacl -R -muser:apache:r-x www*
setfacl -R -mdefault:user:apache:r-x www*

I end up with this:

# getfacl www.somesite.com/
# file: www.somesite.com
# owner: someuser
# group: someuser
user::rwx
user:apache:r-x
group::r-x
mask::r-x
other::r-x
default:user::rwx
default:user:apache:r-x
default:group::r-x
default:mask::r-x
default:other::r-x

This all works nicely, and so long as users are running cgi scripts 
under suexec, they can write to files. But if they are running php as a 
module in apache, they can no longer write to files, even if they do 
'chmod 777 filename', since apache is restricted by the acl.

I can simply 'setfacl -b filename' to remove the restriction, but this 
is an unwanted extra step.

Is there any way to tell the acl system to enforce the most permissive 
file permissions (the primary permissions), rather than the most 
restrictive (the acl) in this case? From what I've read, it doesn't look 
possible. Any other ideas?

Thanks,
Ken Anderson
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel