In this article, we show how to install CageFS (a Cloudlinux feature) and enable it with LiteSpeed Web Server.

Detailed installation instructions for CageFS can be found at http://docs.cloudlinux.com/index.html?cagefs_installation.html

CageFS, previously known as SecureLVE, is a security extension of CloudLinux. It creates a virtualized file system and set of tools for each end user. This makes sure that each user can see only their own files and tools. The separation is preserved for shell scripts, CGI scripts, and cronjobs as well.

To install CageFS, run:

# yum install cagefs
# /usr/sbin/cagefsctl --init

* This last command initializes a CageFS template (aka a skeleton). This skeleton directory can be around 7GB in size. If there is not enough disk space for this skeleton in /usr/share, use the following commands before initializing to have cagefs-skeleton placed in a different location:

# mkdir /home/cagefs-skeleton
# ln -s /home/cagefs-skeleton /usr/share/cagefs-skeleton

Note: On cPanel servers, if you will be placing the skeleton into the /home directory, you must turn off the home directory matching value (cPanel WHM → Server Configuration → Basic cPanel/WHM Setup → Basic Config → Additional home directories…) Change the value to blank (not the default “home”) to turn it off. If you do not change this option, cPanel will create new accounts in incorrect places.

Once you have initialized the template you can start enabling users. By default, CageFS is disabled for all users.

In CageFS, each jailed user can only see system directories and system information that has been mounted in the skeleton. (They can also see their own non-system files.) You can configure which directories are mounted in the skeleton by editing the /etc/cagefs/cagefs.mp file. Use the following command to create this file:

# /usr/sbin/cagefsctl --create-mp

A guided to editing this file can be found at http://docs.cloudlinux.com/index.html?mount_points.html. If you make updates to the system in the future, you can update what's mounted in the skeleton by running:

# /usr/sbin/cagefsctl --create-mp
# /usr/sbin/cagefsctl --remount-all
# /usr/sbin/cagefsctl --update

To enable CageFS for a user:

# /usr/sbin/cagefsctl --enable <username>

To enable CageFS for all users:

# /usr/sbin/cagefsctl --enable-all

To disable CageFS for a user:

# /usr/sbin/cagefs --disable <username>

cagefsctl options

-i | --init        : initialize CageFS (creates CageFS if it does not exist)
-r | --reinit      : reinitialize CageFS (makes a backup and recreates CageFS)
-u | --update      : update CageFS files (adds new and modified files to CageFS,
                    removes unneeded files)
    --update-etc  : update /etc template only          
-f | --force       : recreate CageFS (does not make backup, overwrites existing files)
-d | --dont-clean  : do not delete any files from skeleton (use with --update option)
-k | --hardlink    : use hardlinks if possible
    --create-mp   : create /etc/cagefs/cagefs.mp file (the mount point configuration file)
    --mount-skel  : mount CageFS skeleton directory and start cagefs-fuse service (if not started)
    --unmount-skel: unmount CageFS skeleton directory and stop cagefs-fuse service (if started)
    --remove-all  : disable CageFS, remove templates and /var/cagefs directory

Since version 4.1.12, LSWS has supported CageFS. Once enabled, the user's virtual host will be chrooted/jailed in CageFS.

To enable in LSWS, go to Configuration > Server > General > CloudLinux and set CloudLinux to CageFS or CageFS without suEXEC.

A LSWS mount point will be included in the skeleton automatically if LSWS is installed prior to CageFS.

If LSWS gets installed after CageFS, run following command to get LSWS added to the skeleton:

# /usr/sbin/cagefsctl --create-mp 

# /usr/sbin/cagefsctl --remount-all
# /usr/sbin/cagefsctl --update

NOTE: If the update mentions needing to force update, force the update.

# /usr/sbin/cagefsctl --enable username

root@cptest [~]# su - username
test1@cptest [~]# cat /etc/passwd
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
root:x:0:0:root:/root:/bin/bash
test1:x:502:500::/home/username:/bin/bash

In this test, note that the output of the cat command yields no information for other users.

test1@cptest [~]# ls -l /usr/local/lsws/fcgi-bin/
total 175216
drwxr-xr-x  2 root root     4096 Mar 18 12:31 ./
drwxr-xr-x 15 root root     4096 Mar 31 05:07 ../
-r-xr-xr-x  1 root root     3773 Mar 26 14:37 RackRunner.rb*
-r-xr-xr-x  1 root root     4714 Mar 26 14:37 RailsRunner.rb*
-r-xr-xr-x  1 root root     1095 Mar 26 14:37 RailsRunner.rb.2.3*
-rw-r--r--  1 root root      632 Mar 15 14:39 error_log
-r-xr-xr-x  1 root root     3342 Jan  7 20:43 lsperld.fpl*
-r-xr-xr-x  1 root root  2280672 Jan  7 20:43 lsphp*
-rwxr-xr-x  1 root root 22214525 Jan  9 22:07 lsphp-5.3.20*
-rwxr-xr-x  1 root root 22214525 Jan  8 14:37 lsphp-5.3.20.bak*
-rwxr-xr-x  1 root root 26077761 Feb 28 19:46 lsphp-5.3.22*
-rwxr-xr-x  1 root root 26080599 Mar 12 17:49 lsphp-5.3.22-6.2*
-rwxr-xr-x  1 root root 22213832 Feb 27 18:59 lsphp-5.3.22.bak*
-rwxr-xr-x  1 root root 29145362 Mar 18 12:31 lsphp-5.4.12*
-rwxr-xr-x  1 root root 29145362 Mar 14 12:47 lsphp-5.4.12.bak*
lrwxrwxrwx  1 root root        7 Jan  7 20:43 lsphp4 -> ./lsphp*
lrwxrwxrwx  1 root root       12 Mar 18 12:31 lsphp5 -> lsphp-5.4.12*
test1@cptest [~]# 

Create a test file under the document root as follows:

test1@cptest [~]# vi test.php
<?php
$passwd=`cat /etc/passwd`;
echo "<pre>$passwd</pre>", "\n";
?>

Pointing the browser to http://test1.example.com/test.php should show the following: (Only the user's own /etc/passwd is visible to the jailed vhost.)

smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
root:x:0:0:root:/root:/bin/bash
test1:x:502:500::/home/test1:/bin/bash

We are going to compile a new PHP to test this. First we compile the PHP (e.g. 5.4.14) in the LSWS WebAdmin console as normal. When we are done we can see the new PHP at the bottom of our output below:

root@cptest [~]# ls -l /usr/local/lsws/fcgi-bin/
total 203684
drwxr-xr-x  2 root root     4096 May  8 16:29 ./
drwxr-xr-x 15 root root     4096 Mar 31 05:07 ../
-r-xr-xr-x  1 root root     3773 Mar 26 14:37 RackRunner.rb*
-r-xr-xr-x  1 root root     4714 Mar 26 14:37 RailsRunner.rb*
-r-xr-xr-x  1 root root     1095 Mar 26 14:37 RailsRunner.rb.2.3*
-rw-r--r--  1 root root      632 Mar 15 14:39 error_log
-r-xr-xr-x  1 root root     3342 Jan  7 20:43 lsperld.fpl*
-r-xr-xr-x  1 root root  2280672 Jan  7 20:43 lsphp*
-rwxr-xr-x  1 root root 22214525 Jan  9 22:07 lsphp-5.3.20*
-rwxr-xr-x  1 root root 22214525 Jan  8 14:37 lsphp-5.3.20.bak*
-rwxr-xr-x  1 root root 26077761 Feb 28 19:46 lsphp-5.3.22*
-rwxr-xr-x  1 root root 26080599 Mar 12 17:49 lsphp-5.3.22-6.2*
-rwxr-xr-x  1 root root 22213832 Feb 27 18:59 lsphp-5.3.22.bak*
-rwxr-xr-x  1 root root 29145362 Mar 18 12:31 lsphp-5.4.12*
-rwxr-xr-x  1 root root 29145362 Mar 14 12:47 lsphp-5.4.12.bak*
-rwxr-xr-x  1 root root 29147575 May  8 16:29 lsphp-5.4.14*
lrwxrwxrwx  1 root root        7 Jan  7 20:43 lsphp4 -> ./lsphp*
lrwxrwxrwx  1 root root       12 May  8 16:29 lsphp5 -> lsphp-5.4.14*
root@cptest [~]# 

If we then switch to user “test1” we can still see this new PHP without having to remount anything:

[root@cptest ~]# su - test1
test1@cptest [~]# ls -l /usr/local/lsws/fcgi-bin/
total 203684
drwxr-xr-x  2 root root     4096 May  8 16:29 ./
drwxr-xr-x 15 root root     4096 Mar 31 05:07 ../
-r-xr-xr-x  1 root root     3773 Mar 26 14:37 RackRunner.rb*
-r-xr-xr-x  1 root root     4714 Mar 26 14:37 RailsRunner.rb*
-r-xr-xr-x  1 root root     1095 Mar 26 14:37 RailsRunner.rb.2.3*
-rw-r--r--  1 root root      632 Mar 15 14:39 error_log
-r-xr-xr-x  1 root root     3342 Jan  7 20:43 lsperld.fpl*
-r-xr-xr-x  1 root root  2280672 Jan  7 20:43 lsphp*
-rwxr-xr-x  1 root root 22214525 Jan  9 22:07 lsphp-5.3.20*
-rwxr-xr-x  1 root root 22214525 Jan  8 14:37 lsphp-5.3.20.bak*
-rwxr-xr-x  1 root root 26077761 Feb 28 19:46 lsphp-5.3.22*
-rwxr-xr-x  1 root root 26080599 Mar 12 17:49 lsphp-5.3.22-6.2*
-rwxr-xr-x  1 root root 22213832 Feb 27 18:59 lsphp-5.3.22.bak*
-rwxr-xr-x  1 root root 29145362 Mar 18 12:31 lsphp-5.4.12*
-rwxr-xr-x  1 root root 29145362 Mar 14 12:47 lsphp-5.4.12.bak*
-rwxr-xr-x  1 root root 29147575 May  8 16:29 lsphp-5.4.14*
lrwxrwxrwx  1 root root        7 Jan  7 20:43 lsphp4 -> ./lsphp*
lrwxrwxrwx  1 root root       12 May  8 16:29 lsphp5 -> lsphp-5.4.14*
test1@cptest [~]#