I'm seeing a number of PRs that suexec when used under worker doesn't
work at all (silently doesn't work!). Can anyone reproduce this?
That said, there are a disturbing number of PRs related to suexec in
bugzilla - we really need someone to go through and verify these
bugs - otherwise, I'm slightly afraid that suexec is teetering
towards being abandoned. And, an abandoned suexec with bugs is
a big security hole, IMHO.
This is a message from the person who originally filed PR 7810.
I am not familiar enough with mod_cgid to verify his patch or
to get suexec working with worker. -- justin
--- Begin Message ---
Justin,
Thanks for looking into and resolving that bug, using the
CVS copy now, no problems with the prefork mpm. Can see
how your patch is more efficient and sensible than mine.
I'm not entirely sure wether marking the bug as resolved
was an entirely good idea thuogh, it's still only partially
fixed. The much more dangerous behaviour exhibited by
mod_cgid is still evident.
I'm still looking into it and trying to locate what the
problem is. I can't say this enough, this is a major
security hole. ./configure --with-mpm=worker with suexec
will produce a fully working apache that will not do
what the admin wants, cgi will run as the apache user
and unless the admin actually thinks to check the uid/gid
of the cgi's will not know any better.
Anyway, this patch is definitely something that's needed at some stage :
Index: mod_cgid.c
===================================================================
RCS file: /home/cvspublic/httpd-2.0/modules/generators/mod_cgid.c,v
retrieving revision 1.128
diff -u -r1.128 mod_cgid.c
--- mod_cgid.c 22 Apr 2002 08:08:38 -0000 1.128
+++ mod_cgid.c 28 Apr 2002 13:14:55 -0000
@@ -337,6 +337,10 @@
if (rc != sizeof(gid_t)) {
return 1;
}
+ rc = read(fd, &suexec_cfg->ugid.userdir, sizeof(int));
+ if (rc != sizeof(int)) {
+ return 1;
+ }
rc = read(fd, &suexec_cfg->active, sizeof(int));
if (rc != sizeof(int)) {
return 1;
@@ -443,6 +447,7 @@
write(fd, &suexec_mod->module_index, sizeof(int));
write(fd, &suexec_cfg->ugid.uid, sizeof(uid_t));
write(fd, &suexec_cfg->ugid.gid, sizeof(gid_t));
+ write(fd, &suexec_cfg->ugid.userdir, sizeof(int));
write(fd, &suexec_cfg->active, sizeof(int));
}
it's just to integrate the change you made to the ugid structure
to mod_cgid.
Anyway, I'm going to continue to try and trace the problems
in mod_cgid, because it's what I want to use, this isnt proving
easy, but in the meantime, it might be usefull to document
that mod_cgid + suexec simply does not work.
--
[EMAIL PROTECTED] [EMAIL PROTECTED]
--- End Message ---
