PHP user = root?

Portal Home > Knowledgebase > Articles Database > PHP user = root?

Posted by Looie, 09-11-2011, 03:17 PM
in the $_SERVER array, the user is showing as "root" I know you shouldn't run things as root, so I'm curious as to why it's showing root as the user. I installed lighttpd + php5-cgi as root, but then stopped it and started it under my own user id using sudo and init.d. in the lighttpd conf file, it shows the user as www-data. why is it showing root as the user? does it even matter?
Posted by whmcsguru, 09-12-2011, 08:07 AM
Is it showing as root in a web page, or an application? The difference is there, obviously. If you're calling an app as 'root', including php, it will always show the 'root' user. If you're calling it in a webpage, it should show 'nobody', or 'apache'
Posted by 8088, 09-12-2011, 08:45 AM
I'm not sure why $_SERVER shows the user as root, but an easy way to see who the owner of the process is, is using ps on the command line. Another way is to create a new file and then check its owner. www-data most likely, or whatever server.username is set to in lighttpd.conf.
Posted by Looie, 09-12-2011, 05:55 PM
If I reboot the server, print_r($_SERVER) won't show [USER] if I log in as my own user, then use sudo to stop and start lighttpd, it then shows [USER] => root ps aux shows www-data 4722 0.0 1.2 5952 1636 ? S 21:53 0:00 /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf www-data 4724 0.0 3.7 17812 4964 ? Ss 21:53 0:00 /usr/bin/php5-cgi www-data 4729 0.0 2.4 18068 3172 ? S 21:53 0:00 /usr/bin/php5-cgi
Posted by Looie, 09-12-2011, 05:56 PM
double post
Posted by 8088, 09-12-2011, 06:00 PM
Looks ok to me.
Posted by rnts, 09-13-2011, 08:28 AM
Might be the owner of the "test-page", the USER-index should only be availible when running via CLI, but i think php5-cgi uses that so it looks alright to me as well. //T
Posted by 8088, 09-14-2011, 09:45 AM
I tested that and found out it's not.
Posted by Looie, 09-14-2011, 01:46 PM
Yeah, I just tested it as well, and it's not the owner of the page It's strange how it doesn't appear on startup, but does when I restart the service (either as root or as myself using sudo) I'm sure it doesn't matter anyway, but I'm still curious if anybody knows
Posted by luki, 09-15-2011, 10:32 PM
This environment variable is set by the shell to the currently logged in user. If you (re)start apache from the shell, the child process (apache) will inherit this variable and show it as root. On a reboot, there is no logged in user so the variable is not set. Same also applies to SSH_CLIENT, SSH_CONNECTION, etc. though I'm not sure if apache clears those variables or not.
Posted by 8088, 09-16-2011, 08:50 PM
That sounds plausible, but this is about lighttpd with php-cgi. Would this still apply then?
Posted by luki, 09-16-2011, 09:41 PM
I think so. Children generally inherit the parent's environment, unless the parent cleans it up. So shell -> lighttpd -> php-cgi.