0

I want to use a named pipe for communication between a PHP server-script and a service, i.e. a process (a Python script) listening on the other end of the pipe. This service runs intentionally under a non-priviledged user and also creates the pipe with some Python command equivalent to mkfifo mypipe. This yields a pseudo-file mypipe owned by this non-priviledged user.

Since the PHP-script runs as a different user, it cannot write to that pipe immediately. Of course there are various way to resolve the issue. However, I want to avoid possible security pitfalls.

So, my question is in which directory I should place the named pipe (server directory is /var/www), which owner and permissions it should have and, finally, how and where I should validate (escape) the content sent from the PHP-script to the service.

closed as too broad by DavidPostill Sep 15 '18 at 15:54

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

There are many questions here, some of which do not have a canonical answer. So please read this as my $0.02, not as a "fundamental truth".

  • Input validation: I consider it diligent to validate input as early as possible, in your case this would be once immediately after the PHP script starts up, the second time immediately after the python script has received the request via the FIFO, and the third time after the PHP script has received the reply from the FIFO.
  • Interface data format (escaping): You could (and IMHO should) try to use a battle-tested library to help you achieve that: JSON comes to mind, as both PHP and Python have good encoding/decoding libraries. In this case, I'd encode the data immediately before writing it to the FIFO and decode it immediately after. In fact you might want to consider a "send_to_interface" / "receive_from_interface" method pair on each side, that combines encoding/writing resp. reading/decoding into an atom. If ever you want to use a different interface mechanism, you just need to create a new pair of pairs without the need to touch the rest of the code.
  • FIFO ownership and privileges: I'd go the route of creating a group consisting of only the service user and the www user, then do a chgrp servicegroup && chmod 660 on the FIFO. You might als want to research using a socket instead of a FIFO - this eases the privileges situation and prepares you for a situation, where the service and the webserver do not run on the same machine. Depending on what your python service does, it might also pay off to run it in a web layer and use cURL on the PHP side to access it. The encapsulation suggested in the bullet before makes it easy to switch between such different mechanisms.
  • Thanks for the insights. As I am already using JSON for the transfer so, if you know, I could use help on how to do the escaping using encoding/decoding libraries on both ends (or can I consider the standard libraries secure). With regards to the chgrp servicegroup it troubles me a bit that I probably would need to either add an entry to the sudoers file for the service user in order to get the permissions to change the group or to create an initialization script to execute the command with privileges. – highsciguy Sep 15 '18 at 12:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.