I want to use a named pipe for communication between a PHP server-script and a service, i.e. a process (a Python script) listening on the other end of the pipe. This service runs intentionally under a non-priviledged user and also creates the pipe with some Python command equivalent to
mkfifo mypipe. This yields a pseudo-file
mypipe owned by this non-priviledged user.
Since the PHP-script runs as a different user, it cannot write to that pipe immediately. Of course there are various way to resolve the issue. However, I want to avoid possible security pitfalls.
So, my question is in which directory I should place the named pipe (server directory is /var/www), which owner and permissions it should have and, finally, how and where I should validate (escape) the content sent from the PHP-script to the service.