[Bug 69543] New: SymLinksIfOwnerMatch do not work

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=69543

            Bug ID: 69543
           Summary: SymLinksIfOwnerMatch do not work
           Product: Apache httpd-2
           Version: 2.5-HEAD
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P2
         Component: Runtime Config
          Assignee: bugs@httpd.apache.org
          Reporter: looknear@gmail.com
  Target Milestone: ---

+SymLinksIfOwnerMatch -FollowSymLinks options was intended to increase
security.
to make sure we follow ONLY symlinks to targets that has the same owner of the
links.

the idea is nice, to have www-data owned symlinks that follow to folders we
make sure owned also by www-data
to prevent a case of hacking the site, as www-data, creating a symlink to ROOT
owned folders for example...

this is not working.
the test is easy, under the root directory of the website, lets say
/var/www/html/my-site , create a symlink owned by www-data, that target a
folder on external drive, folder that is owned by root.
apache is following it with no issues.

this is a potential security bug. 
as +SymLinksIfOwnerMatch -FollowSymLinks behave just like full enabled
+FollowSymLinks

(in another note, could be great to disable symlinks altogether and use Aliases
for few folders, that could be more secure, BUT then Rewrite rules are not
working... and this is needed for many frameworks)

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 69543] SymLinksIfOwnerMatch do not work

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=69543

--- Comment #1 from Bjoern Voigt <bj...@arcor.de> ---
I think, nearly nobody directly needs the options FollowSymLinks and
SymLinksIfOwnerMatch directly.

The main reason, why many users activate SymLinksIfOwnerMatch is, that they
want to use mod_rewrite and SymLinksIfOwnerMatch is a requirement for
mod_rewrite.

The best strategy would be to fix mod_rewrite and thus get rid of
SymLinksIfOwnerMatch in many setups.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 69543] SymLinksIfOwnerMatch do not work

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=69543

--- Comment #2 from LookNear <lo...@gmail.com> ---
I do not agree with you Bjoern. If these two flags would work as planned - it
could be an important use for security.
If you do not have any symlinks in your docroot - just disable it. it will
prevent any hack link outside of your rootdir.
but if you have symlinks, and many have, to an external drive for example, then
you want to follow symlonks but also to add restrictions on it.
with a normal user management ,  SymLinksIfOwnerMatch will let you use your
symlinks but NOT to follow ones that are leading outside of your server domain.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org