httpd-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 53581] New: FollowSymlinks doesn't work with DirectoryMatch and Alias
Date Sat, 21 Jul 2012 22:40:18 GMT
https://issues.apache.org/bugzilla/show_bug.cgi?id=53581

          Priority: P2
            Bug ID: 53581
          Assignee: bugs@httpd.apache.org
           Summary: FollowSymlinks doesn't work with DirectoryMatch and
                    Alias
          Severity: normal
    Classification: Unclassified
                OS: All
          Reporter: calestyo@scientia.net
          Hardware: All
            Status: NEW
           Version: 2.2.16
         Component: All
           Product: Apache httpd-2

Hi.

I found a strange issue...
What I have is about the following:

        Alias /icinga/images/icinga/favicon.ico
/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga/images/icinga/favicon.ico

...

        <DirectoryMatch
"^(?:/usr/share/icinga-web/app/modules/\w+/pub/images|/usr/share/icinga-web/app/modules/\w+/pub/styles|/usr/share/icinga-web/lib/ext3|/usr/share/icinga-web/pub|/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga(?!/classic))/">

#some stuff adding authorization control
        </DirectoryMatch>

        <DirectoryMatch
"^/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga(?!/classic)/">
                Options +symLinksIfOwnerMatch
        </DirectoryMatch>


In /srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga
there is a symlink, pointing to the favicon.ico.



So the idea is the following:
A user accesses /icinga/images/icinga/favicon.ico which is aliased to
/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga/images/icinga/favicon.ico
which is a symlink to some other place.

The first DirectoryMatch matches some other dirs and the dir where I'm aliasing
to (without the subdir classic).... and adds some general rules (mainly
authorisation).

The second DirectoryMatch matches only:
/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga
and subdirs (except classic) thereof.

I'd have expected that access is granted (due to the Options
+symLinksIfOwnerMatch) but I get a forbidden and:
[Sun Jul 22 00:26:36 2012] [error] [client 1.2.3.4] Symbolic link not allowed
or link target not accessible:
/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga/images/icinga/favicon.ico
in the error log.

Actually the above thing exactly works if I replace the 2nd DirectoryMatch
with:
        <Directory
/srv/www/external/virtual-hosts/lcg-lrz-monitoring.grid.lrz.de/custom/icinga>
                Options +symLinksIfOwnerMatch
        </Directory>
which is however not a real solution, as I don't want to match the classic
subdir(s).

Changing to +followSymlinks doesn't change.

It somehow seems as if followSymlinks/symLinksIfOwnerMatch don't work in
DirectoryMatch blocks.


Any ideas?


Chris.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org


Mime
View raw message