Re: [gentoo-user] Gentoo location for squirrelmail attachments

[Michael Orlitzky <michael@orlitzky.com>]

On 12/09/2011 10:49 AM, Grant wrote:
>
> There is a Squirrelmail document recommending that the Squirrelmail
> data and attachments directories are established outside of the web
> server's reach.  /var is given as an example.

The two aren't mutually exclusive; using the previous example, we have,

   php_admin_value upload_tmp_dir /var/www/example.com/www/tmp
   DocumentRoot                   /var/www/example.com/www/public

so Apache can't serve up the temporary files. But sticking them both 
under /var/www/example.com/www does allow you to use tighter 
open_basedir restrictions.


> This is a little disturbing because my Squirrelmail data directory was
> created under the webroot as apache:apache 0755 at some point.  Would
> this have been done by Gentoo?  Should I file a bug?

I'm not sure. There's probably a policy that says one of two things:

   1. Ebuilds should by default set up everything as securely as
      possible, or

   2. Ebuilds should not mess with upstream

I've honestly never used Gentoo's webapp stuff; it confuses the hell out 
of me.