www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Tom Lear <t...@accesscom.com>
Subject suexec/1954: suexec directory checks - needed user cgi's under root owned dir
Date Mon, 16 Mar 1998 19:58:17 GMT

>Number:         1954
>Category:       suexec
>Synopsis:       suexec directory checks - needed user cgi's under root owned dir
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          change-request
>Submitter-Id:   apache
>Arrival-Date:   Mon Mar 16 12:00:01 PST 1998
>Last-Modified:
>Originator:     toml@accesscom.com
>Organization:
apache
>Release:        1.2+
>Environment:
Linux paranoid 2.0.29 #2 Sat Oct 18 10:08:38 PDT 1997 i586 unknown
gcc 2.7.2.1
>Description:
We needed to run users cgi's from a directory owned by root, so I added a
compile time option to suexec to allow the dir owner and the cgi owner to
mismatch if the dir owner is root.
>How-To-Repeat:

>Fix:
Here's the patch:
diff -C 3 orig/suexec.c ./suexec.c
*** orig/suexec.c       Wed Jan  7 12:34:43 1998
--- ./suexec.c  Wed Jan  7 12:23:33 1998
***************
*** 464,470 ****
       * Error out if the target name/group is different from
       * the name/group of the cwd or the program.
       */
!     if ((uid != dir_info.st_uid) ||
        (gid != dir_info.st_gid) ||
        (uid != prg_info.st_uid) ||
        (gid != prg_info.st_gid)) {
--- 464,474 ----
       * Error out if the target name/group is different from
       * the name/group of the cwd or the program.
       */
!     if (((uid != dir_info.st_uid
! #ifdef ROOT_OWNS_DIR
!         && dir_info.st_uid!=0
! #endif
!         )) ||
        (gid != dir_info.st_gid) ||
        (uid != prg_info.st_uid) ||
        (gid != prg_info.st_gid)) {
diff -C 3 orig/suexec.h ./suexec.h
*** orig/suexec.h       Wed Jan  7 12:34:54 1998
--- ./suexec.h  Wed Jan  7 12:55:52 1998
***************
*** 135,138 ****
--- 135,150 ----
  #define SAFE_PATH "/usr/local/bin:/usr/bin:/bin"
  #endif
  
+ /*
+  * ROOT_OWNS_DIR -- Allow uid of direcory to be different from uid of
+  *                  executable, if directory is owned by root.
+  *                In some situations this makes more sense than to
+  *                require that the owner of the cgi own the directory
+  *                the cgi exists in.
+  *
+  */
+ #ifndef ROOT_OWNS_DIR
+ //#define ROOT_OWNS_DIR ""
+ #endif
+ 
  #endif /* _SUEXEC_H */

%0
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <apbugs@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]




Mime
View raw message