Suexec and Apache: A Tutorial Page 2

The requested script must be a valid Web-space reference relative to the user's directory or the DocumentRoot; it cannot be an absolute filesystem path (i.e., it cannot start with a "/") and cannot include any up-level references (i.e., no "../" references either).

As you can see, the requirements for execution are pretty stringent. The sheer number of things that can go wrong argues for the use of the wrapper only when it's really necessary.

Enabling suexec

The suexec wrapper isn't turned on or off by any particular Apache directive setting. Instead, when the Apache server is compiled, one of the constants set (SUEXEC_BIN) is a string pointing to the location of the suexec binary. When the server starts, it looks for the binary at that location; if it's found, suexec is enabled--not otherwise. This is very important.

This means that even a normal Apache build that was performed without any thought given to using the wrapper can suddenly become suexec-enabled if a properly protected suexec binary is put into place between server restarts. In the master sources, the default value of SUEXEC_BIN is set to "/sbin/suexec"; the default value of HTTPD_ROOT is platform-specific:

You may change the values of either--or both--of the HTTPD_ROOT and SUEXEC_BIN constants when you recompile the Apache server.