Return-Path: 
 <users-return-83631-apmail-httpd-users-archive=httpd.apache.org@httpd.apache.org>
Delivered-To: apmail-httpd-users-archive@www.apache.org
Received: (qmail 89287 invoked from network); 4 Oct 2008 23:08:23 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 4 Oct 2008 23:08:23 -0000
Received: (qmail 6372 invoked by uid 500); 4 Oct 2008 23:08:11 -0000
Delivered-To: apmail-httpd-users-archive@httpd.apache.org
Received: (qmail 6351 invoked by uid 500); 4 Oct 2008 23:08:11 -0000
Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
list-help: <mailto:users-help@httpd.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@httpd.apache.org>
List-Post: <mailto:users@httpd.apache.org>
List-Id: <users.httpd.apache.org>
Delivered-To: mailing list users@httpd.apache.org
Received: (qmail 6340 invoked by uid 99); 4 Oct 2008 23:08:11 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 04 Oct 2008 16:08:11 -0700
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Received: from [134.71.247.19] (HELO sparky.unx.csupomona.edu) (134.71.247.19)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 04 Oct 2008 23:07:07 +0000
Received: from localhost (localhost [127.0.0.1])
	by sparky.unx.csupomona.edu (Postfix) with ESMTP id A5D3FDC0E5
	for <users@httpd.apache.org>; Sat,  4 Oct 2008 16:07:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at csupomona.edu
Received: from sparky.unx.csupomona.edu ([127.0.0.1])
	by localhost (sparky.unx.csupomona.edu [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id kMwHsRUdKbEl for <users@httpd.apache.org>;
	Sat,  4 Oct 2008 16:07:41 -0700 (PDT)
Received: from loogie.intranet.csupomona.edu (loogie.intranet.csupomona.edu
 [134.71.184.48])
	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
	(No client certificate requested)
	by sparky.unx.csupomona.edu (Postfix) with ESMTP id 8301CDC0D8
	for <users@httpd.apache.org>; Sat,  4 Oct 2008 16:07:41 -0700 (PDT)
Date: Sat, 4 Oct 2008 16:07:41 -0700 (PDT)
From: "Paul B. Henson" <henson@acm.org>
X-X-Sender: henson@loogie.intranet.csupomona.edu
To: users@httpd.apache.org
In-Reply-To: <48E7A0B8.7080805@ice-sa.com>
Message-ID: <Pine.GSO.4.55.0810041555440.15613@loogie.intranet.csupomona.edu>
References: <Pine.GSO.4.55.0810031402090.15613@loogie.intranet.csupomona.edu>
 <c31975b60810031911u22837438oa6bce12f697199d9@mail.gmail.com>
 <Pine.GSO.4.55.0810031938220.333@loogie.intranet.csupomona.edu>
 <c31975b60810032213l271282bev3735b2963e08706a@mail.gmail.com>
 <Pine.GSO.4.55.0810040833260.15613@loogie.intranet.csupomona.edu>
 <48E7A0B8.7080805@ice-sa.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=X-UNKNOWN
Content-Transfer-Encoding: 8BIT
X-Virus-Checked: Checked by ClamAV on apache.org
Subject: Re: [users@httpd] SSI/server-side includes and symbolic
 links/SymlinkIfOwnerMatch

On Sat, 4 Oct 2008, [iso-8859-1] Andr� Warnier wrote:

> In other words, check if by any chance you do not have some <Location>
> section negating all your configuration snippets for that <Directory>.

I'm pretty sure the config is ok; the following are exerpts from my actual
config of all Directory/Location sections. Also, the config works fine for
non-SSI accessed symbolic links. For example, if
/export/user/bob/www/test.html (owned by bob) is a symlink to
/export/user/fred/www/foo.html (owned by fred), accessing /~bob/test.html
fails, and a symbolic link failure is logged. However, if
/export/user/bob/www/test_ssi.html contains an include (either
file=/export/user/bob/www/test.html or virtual=/~bob/test.html), accessing
/~bob/test_ssi.html successfully delivers the content of
/export/user/fred/www/foo.html via the include of the symbolic link, even
though the ownership differs.

This was unexpected and problematic for my intended implementation...

[...]
<Directory />
        Options FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
</Directory>
[...]
<Directory "/usr/pkg/share/httpd/htdocs">
        Options Indexes FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
</Directory>
[...]
<Directory "/usr/pkg/libexec/cgi-bin">
        SSLOptions +StdEnvVars
        AllowOverride None
        Options None
        Order allow,deny
        Allow from all
</Directory>
[...]
<Directory "/export/user/*/www">
[...]
        Options Indexes SymLinksIfOwnerMatch IncludesNoExec
[...]
</Directory>
[...]
<Directory "/export/group/*/www">
[...]
        Options Indexes SymLinksIfOwnerMatch IncludesNoExec
[...]
</Directory>
[...]
<Location /server-status>
        SetHandler server-status
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
</Location>
[...]
<Directory "/usr/pkg/share/httpd/icons">
        Options Indexes MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
</Directory>


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.csupomona.edu/~henson/
Operating Systems and Network Analyst  |  henson@csupomona.edu
California State Polytechnic University  |  Pomona CA 91768

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org