FastCGI "user" doesn't work

Question

hi,
i'm running Web Server 7.0U4 on Solaris 10U6. i have several virtual hosts which contain PHP applications using FastCGI, most of which run as the web server user. however, in one particular virtual host, i'd like PHP to run as a different user.
in the admin console, i can enter a username and group in the FastCGI responder configuration, but the changes aren't saved. if i re-open the configuration, the user field is blank, instead of containing the value i entered.
i tried to configure this in <vhost>-obj.conf instead:
Service fn="responder-fastcgi" type="application/x-php" app-path="/opt/php/bin/php-cgi" user="accounts"however, the PHP scripts are still running as the web server user, not the user i specified.
what am i missing?

Answer 1

note : if you want to start the fastcgi with a user other than web server runtime user, then you will need to start the server as 'root' . however, there is no any security hole in doing that because web server when started as root spawns another web server process (with the user name as mentioned within config/server.xml) and this is what listens to incoming request.I believe that you are wrong about this Sriram.
The lineage of the FastCGI process is this:
webservd-wdog -> webservd -> webservd -> Fastcgistub -> FCGI Process
On my system WS is configured to run as nobody. The UID order of each of the above processes is:
root -> root -> nobody -> nobody -> nobody
The watchdog has root because it binds to privileged ports as needed and "passes" those FDs to its child, the primordial webserver process, as needed.
The primordial webserver process (which does not handle any requests) is responsible for spawning the worker process in the event of abnormal process terminal. It retains root privileges for much the same reason that watchdog does.
The worker webserver process (the one that actually does the heavy lifting of being a web server) setuid()s itself to the configured user when the process is created. At this point is has given up privileged access and is now restricted to whatever the privileges are that it is configured to run as. All of its children (Fastcgistub and the FCGI processes themselves) inherit this UID from the worker process. In order for them to setuid() themselves to something else they need to start with a UID that has permission to actually perform a setuid(). Typically "nobody" and "webervd" do not have this permission.
Read up on CAP_SETUID (I know this is relevant on Linux, but I believe this is a POSIX thing and should apply to other Unices).
Note that it's also been a long time since I delved into the internals of Web Server. Maybe the inheritance system has changed in ways I'm unfamiliar with. Anyone feel like scrubbing through the Open Web Server code (I know the FastCGI system is in there) to check for certain?