I am very confused and concerned about the user ownership of commands run via the PHP "exec" statement. I am running PHP 5.5/Apache 2.2/CENTOS 6 in a cPanel/WHM environment with the DSO/mod_ruid handler.
In a test, I have the following php script:
<?php
echo 'whoami: ',exec('whoami'),'<br />';
echo 'user: ',exec('echo ${USER}'),'<br />';
echo 'home: ',exec('echo ${HOME}'),'<br />';
?>
When I run the script through my browser, I see these results:
whoami: cuser
user: root
home: /root
where cuser is my system's cPanel ID and the user ID in the suPHP, mod_ruid, and mpm-itk directives in my domain's virtual host httpd.conf configuration.
Furthermore, my httpd.conf file assigns "nobody" as the User and Group and, indeed, my httpd processes (as returned from the "ps -ef | grep httpd") are owned by "nobody".
My question is why the exec commands return different results for the "whoami" and "echo ${USER}" commands and whether there is a security risk because of an error in my Apache configuration. Optimally, I'd like my exec commands to run as the cuser user. Can I make that happen?
Thank you very much for any information you can provide.