title: Python mkdir wrong owner
body: <p>I am baffled by this issue, please help:</p>
  
  <p>Running DJANGO, Python 2.7, Apache [mod_wsgi] for DJANGO. When mkdir or a file write happens then the user/group is always root:root. The parent directories are all owned by the Apache UID/GID.</p>
  
  <ol>
  <li>How in the world could Python to do something so dangerous through Apache without directly coding root:root to own the dir?</li>
  <li>I don't mind explicitly forcing the owner via os.chown(), but for a better security practice I would rather it pick up the correct permissions. Any ideas on why this is happening?</li>
  </ol>
  
  <hr>
  
  <p>As requested, more details:</p>
  
  <p>Here is the parent directory:</p>
  
  <pre><code>drwxrwxrwx.  7 apache apache 4096 Jan 16 00:57 archives
  </code></pre>
  
  <p>Here is the folder that was created using os.mkdir() inside of the archives directory:</p>
  
  <pre><code>drwxr-xr-x. 3 root   root   4096 Jan 16 00:57 test_dir
  </code></pre>
  
  <p>I am running Enterprise Linux with Apache running as a service:</p>
  
  <pre><code> [root@s2 archives]# ps wwwwwwwwwwwwwaux | grep httpd
   apache   21634  0.7  5.2 1321760 101400 ?      Sl   Jan12  52:04 /usr/sbin/httpd
   apache   21657  0.0  0.5 329104 10724 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21658  0.0  0.5 329248 10740 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21659  0.0  0.5 329264 10756 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21660  0.0  0.5 329280 10796 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21661  0.0  0.5 329104 10684 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21662  0.0  0.5 329280 10796 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21663  0.0  0.5 329248 10740 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21664  0.0  0.5 329104 10664 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21665  0.0  0.5 329104 10684 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   21666  0.0  0.5 329248 10760 ?        S    Jan12   0:05 /usr/sbin/httpd
   apache   22705  0.0  0.5 329256 10756 ?        S    Jan13   0:05 /usr/sbin/httpd
   apache   22711  0.0  0.5 329240 10696 ?        S    Jan13   0:05 /usr/sbin/httpd
   apache   22752  0.0  0.5 329280 10776 ?        S    Jan13   0:03 /usr/sbin/httpd
   apache   22806  0.0  0.5 329104 10648 ?        S    Jan13   0:02 /usr/sbin/httpd
   root     25238  0.0  0.0 103236   864 pts/0    S+   17:19   0:00 grep httpd
   root     25893  0.0  0.6 326980 13092 ?        Ss    2013   3:52 /usr/sbin/httpd
  </code></pre>
  
  <p>As you can see, the primary service runs as root (standard) and the child processes are forked as the apache user (standard). I can execute PHP or Perl on the same server, via Apache, in the same directory and I get the correct permissions:</p>
  
  <pre><code> drwxr-xr-x. 3 apache apache 4096 Jul 19 23:39 sqa-test1-php
   drwxr-xr-x. 3 apache apache 4096 Jul 22 19:22 sqa-test2-perl
   drwxr-xr-x. 3 apache apache 4096 Dec  4 21:31 sqa-test3-ruby
  </code></pre>
  
  <p>Here is my WSGI config for testing:</p>
  
  <pre><code>  WSGIScriptAlias / "apache/conf/Extra/django_nix.wsgi"
  </code></pre>
  
  <p>-=====-</p>
  
  <p>I can't comment to Ardin because I am using my work account and not my personal account. I understand what you are saying, but that would go back to point #1 that I made above. It is a massive security risk to allow this. Essentially, someone could easily hack a file upload and have it execute as root - in a few minutes I could delete all your backups, download all your databases, wipe out your file system, change the root user password, wipe out the Kernel and reboot the server. The Apache user has no shell access, so shipping and executing a file via that user is one of the best ways to protect your web server. I only know this from battling script kiddies for over a decade that do this all the time to my servers. As a side note: I am new to Python in the Web Space.</p>