Apache & Suexec security [chroot]

[ephigenie]

Yes it is - but solutions to that are not as easy as it seems (for cgi).

We're investigating sbox and a few other scripts laying around.
But all have a huge overhead - so we're looking for something smart and portable (we don't want to include more secondary binary code than necessary) In fact we even have nothing platform depend included (except our daemon).

The problem is not to keep the chroot for the cgi small on start - it's more a problem of the users who want to execute perl or so - they then need to download big binary packages into their webspace ... (because they can't access anything outside)

If anyone got a smart solution for this you're more than welcome !