Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: [Bug 56252] New: make install as privileged user creates files not
 owned by root
Date: Wed, 12 Mar 2014 18:22:53 +0000
Message-ID: <bug-56252-7868@https.issues.apache.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-generated
MIME-Version: 1.0

https://issues.apache.org/bugzilla/show_bug.cgi?id=56252

            Bug ID: 56252
           Summary: make install as privileged user creates files not
                    owned by root
           Product: Apache httpd-2
           Version: 2.4.7
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: Build
          Assignee: bugs@httpd.apache.org
          Reporter: business2008+issues.apache.org@rodneybeede.com

When building apache from sources I perform the following commands as a
non-privileged user:

./configure --with-included-apr

make


For the actual install into my PREFIX (/usr/local/apache2) I execute a
privileged command of:

sudo make install


This results in binaries, files, and directories that are NOT owned by root as
one might expect.

Some example files (all not owned by root):


/usr/local/apache2/bin/apachectl
/usr/local/apache2/bin/envvars-std
/usr/local/apache2/bin/dbmmanage
/usr/local/apache2/bin/envvars
/usr/local/apache2/bin/apxs

/usr/local/apache2/cgi-bin/printenv
/usr/local/apache2/cgi-bin/printenv.wsf
/usr/local/apache2/cgi-bin/printenv.vbs
/usr/local/apache2/cgi-bin/test-cgi

Files inside  /usr/local/apache2/icons/

/usr/local/apache2/error/include/


Suggestion 1:

Modify the build scripts so when running make install any files or directories
copied/created have the ownership and group membership set to the effective uid
running the make install.


Suggestion 2:

At the end of make install echo a comment to remind the admin to check the
permissions of all the files and directories in PREFIX or wherever they
installed for secure values.


Suggestion 3:

Consider automatically setting the file and directory mode to be more
restrictive (e.g. chmod -R o-rwx PREFIX) after the make install.

Another option would be to provide a script or another make command that would
optionally set locked down secure ownership and permissions.  "make install
--secure-permissions" or something similar perhaps.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org