Re: [gentoo-user] Gentoo location for squirrelmail attachments

[Joost Roeleveld <joost@antarean.org>]

On Friday, December 09, 2011 07:49:13 AM Grant wrote:
> >> I ran squirrelmail/configtest.php and realized I don't have an
> >> attachment directory set up for Squirrelmail:
> >> 
> >> ERROR: Attachment dir (/var/local/squirrelmail/attach/) does not
> >> exist!
> >> 
> >> I don't even have a /var/local/.  Would a good Gentoo'er create the
> >> directory in that location?
> > 
> > If a website needs to write files, let it do so under its own directory
> > hierarchy. All of our PHP sites have something equivalent to the
> > following in their apache vhost configs:
> > 
> >  php_admin_value open_basedir /var/www/example.com/www/
> >  php_admin_value upload_tmp_dir /var/www/example.com/www/tmp
> >  php_admin_value session.save_path /var/www/example.com/www/tmp
> > 
> > That way, if www.example.com is compromised, the rest of the machine is
> > still safe (barring PHP bugs).
> 
> There is a Squirrelmail document recommending that the Squirrelmail
> data and attachments directories are established outside of the web
> server's reach.  /var is given as an example.  They also recommend
> root:apache 0730 for both directories.
> 
> This is a little disturbing because my Squirrelmail data directory was
> created under the webroot as apache:apache 0755 at some point.  Would
> this have been done by Gentoo?  Should I file a bug?
> 
> "Prepare data and attachment directories"
> http://squirrelmail.org/docs/admin/admin-3.html
> 
> - Grant

I think the data-directory is included from upstream and is there to have it 
work when installing it "blindly". Recommendations are not always possible 
(think hosted environments)

--
Joost