[users@httpd] SuExec and symlinks

[Oscar Haeger <Os...@nbit.sigma.se>]

Hi.
First I'd like to apologize if this question has been asked before, but I've
scanned the archives and haven't found anything about it.

What I'd like to know is if SuExec somehow prevents me from running scripts via
symlinks.
I have a webserver with SuExec installed and I'd like to be able to run scripts
that resides in other peoples cgi-bin directories. I've tested this but haven't
been able to get it to work. The httpd.conf is set to "FollowSymLinks" wherever
applicable and it does so when pointed to a normal html-page but not when it
comes to cgi's.
In the suexec-log I get this error-msg:
[2005-09-19 09:43:31]: uid: (501/osh) gid: (20/20) cmd: test.cgi
[2005-09-19 09:43:31]: cannot stat program: (test.cgi)
However doing a stat on it does work for me.

I've tried changing the ownership of the link and the "SymLinkIfOwnerMatch" but
that doesn't do anything either.

Any insight in this will be greatly appreciated as I've been struggeling with
this for quite some time now.

Is it so that SuExec simply won't follow symlinks and if so, why doesn't the
logfiles state that instead of the "cannot stat" message?

Thanks in advance

Oscar

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] SuExec and symlinks

[Joshua Slive <js...@gmail.com>]

On 9/19/05, Oscar Haeger <Os...@nbit.sigma.se> wrote:
> What I'd like to know is if SuExec somehow prevents me from running scripts via
> symlinks.
> I have a webserver with SuExec installed and I'd like to be able to run scripts
> that resides in other peoples cgi-bin directories. I've tested this but haven't
> been able to get it to work.

Well, yeah.  Allowing anything symlinked to get executed by suexec
would violate the basic security model.  I agree that neither the
error message nor the docs are very explicit about this, but I think
the assumption is that security-minded people will know that a program
like suexec must forbid symlinks to do its job.

If you know a little c, then reading the suexec.c source code makes
things clear:
    /*
     * Error out if we cannot stat the program.
     */
    if (((lstat(cmd, &prg_info)) != 0) || (S_ISLNK(prg_info.st_mode))) {
        log_err("cannot stat program: (%s)\n", cmd);
        exit(117);
    }

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org