1

I updated to Passenger 5.1.11 today and had cause to look at my Apache error logs.

In /var/log/apache2/error.log I found this entry (many times over):

WARNING: potential privilege escalation vulnerability. Passenger is running as root, and part(s) of the passenger root path (/home/jack/.rbenv/versions/2.2.2/lib/ruby/gems/2.2.0/gems/passenger-5.1.11) can be changed by non-root user(s): The path "/home/jack/.rbenv/versions/2.2.2/lib/ruby/gems/2.2.0/gems/passenger-5.1.11" can be modified by user "jack" (or applications running as that user). Change the owner of the path to root, or avoid running Passenger as root.

I'm running Debian 7 and installed Passenger as a gem. I didn't run any install commands using sudo.

How can I avoid Passenger running as root? I've spent the last couple of hours Googling this, but have come up empty handed.

3 Answers 3

3

Apache starts as root, thus when the Passenger module is loaded it starts as root. In a situation where you are integrating with Nginx or Apache, you are going to find it's much easier to restrict the permissions on the gem dir than it is to run the webserver as a non-root user.

2
  • Unfortunately, I get the same warning for every directory from the path mentioned above, right down to my home directory. Changing the owner of my home directory will be a PITA. How serious is this warning? Could it potentially be ignored or does it need acting on? Oct 20, 2017 at 19:44
  • How serious it is depends on your server, if you only have the one app, and the user passenger runs your app as does not have permission to modify the mentioned paths then you should be ok. The problem is when a user or daemon has permission to modify those paths as they can then achieve privilege escalation. Oct 20, 2017 at 19:48
1

Here's the only real solution that doesn't involve chown everything. Place the following inside your

<virtualhost></virtualhost>

in your website.conf. May also work in apache2.conf

PassengerUserSwitching off
PassengerDefaultUser "your-user-name"

Now check your error log. There should be no more error.

I don't understand why. Passenger docs refer to this as sandboxing. Not sure what other consequences there will be.

Solution obtained from:

https://sun-blog.site/passenger%E3%81%AE%E5%AE%9F%E8%A1%8C%E6%A8%A9%E9%99%90%E3%81%AE%E8%AD%A6%E5%91%8A/
https://blog.masterka.net/archives/1828
via google

1
  • 1
    Thanks for the answer. I will try this next time I set up a Rails app. Mar 14 at 14:41
0

To expand on the accepted answer:

In a situation where you are integrating with Nginx or Apache, you are going to find it's much easier to restrict the permissions on the gem dir than it is to run the webserver as a non-root user.

From https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html

The TCP/IP port numbers below 1024 are special in that normal users are not allowed to run servers on them.

Meaning that if you want to run a web server (typically on port 80 or 443), you should run it as root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.