Re: suexec/4111: SSI #exec cmd="..." does not work with suexec enabled

[co...@apache.org]

[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]


Synopsis: SSI #exec cmd="..." does not work with suexec enabled

Comment-Added-By: coar
Comment-Added-When: Mon May 24 10:51:49 PDT 1999
Comment-Added:
[Text improperly submitted to the bugdb but destined for
this report.]

This patch to suexec will fix that.  See the bottom for a description of
what the option ROOT_OWNS_DIR does.  Apply this patch from the directory
suexec.c & .h are in.
                                                        - Tom

-------- Cut here --------

diff -C 3 orig/suexec.c ./suexec.c
*** orig/suexec.c       Fri May 14 09:48:44 1999
--- ./suexec.c  Fri May 14 09:42:15 1999
***************
*** 423,428 ****
--- 423,438 ----
        exit(111);
      }
  
+ #ifdef ROOT_OWNS_DIR
+     /*
+      * Stat the cwd and verify it is a directory, or error out.
+      */
+     if (((lstat(cwd, &dir_info)) != 0) || !(S_ISDIR(dir_info.st_mode))) {
+       log_err("cannot stat directory: (%s)\n", cwd);
+       exit(115);
+     }
+ #endif
+ 
      if (userdir) {
        if (((chdir(target_homedir)) != 0) ||
            ((chdir(USERDIR_SUFFIX)) != 0) ||
***************
*** 441,451 ****
        }
      }
  
!     if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
        log_err("command not in docroot (%s/%s)\n", cwd, cmd);
        exit(114);
      }
  
      /*
       * Stat the cwd and verify it is a directory, or error out.
       */
--- 451,466 ----
        }
      }
  
!     if (
! #ifdef ROOT_OWNS_DIR
!         (dir_info.st_uid!=0 || dir_info.st_gid!=0) &&
! #endif
!         (strncmp(cwd, dwd, strlen(dwd))) != 0) {
        log_err("command not in docroot (%s/%s)\n", cwd, cmd);
        exit(114);
      }
  
+ #ifndef ROOT_OWNS_DIR
      /*
       * Stat the cwd and verify it is a directory, or error out.
       */
***************
*** 453,458 ****
--- 468,474 ----
        log_err("cannot stat directory: (%s)\n", cwd);
        exit(115);
      }
+ #endif
  
      /*
       * Error out if cwd is writable by others.
***************
*** 490,495 ****
--- 506,514 ----
       * Error out if the target name/group is different from
       * the name/group of the cwd or the program.
       */
+ #ifdef ROOT_OWNS_DIR
+   if (dir_info.st_uid!=0 || dir_info.st_gid!=0) {
+ #endif
      if ((uid != dir_info.st_uid) ||
        (gid != dir_info.st_gid) ||
        (uid != prg_info.st_uid) ||
***************
*** 500,505 ****
--- 519,527 ----
                prg_info.st_uid, prg_info.st_gid);
        exit(120);
      }
+ #ifdef ROOT_OWNS_DIR
+   }
+ #endif
      /*
       * Error out if the program is not executable for the user.
       * Otherwise, she won't find any error in the logs except for
diff -C 3 orig/suexec.h ./suexec.h
*** orig/suexec.h       Fri May 14 09:48:47 1999
--- ./suexec.h  Fri May 14 09:42:15 1999
***************
*** 139,142 ****
--- 139,152 ----
  #define SAFE_PATH "/usr/local/bin:/usr/bin:/bin"
  #endif
  
+ /*
+  * ROOT_OWNS_DIR -- If directory is owned by root.root then any directory/file
+  *                  ownership is acceptable, as well as any docroot.  This
+  *                  allows running of standard system binaries.
+  *
+  */
+ #ifndef ROOT_OWNS_DIR
+ #define ROOT_OWNS_DIR
+ #endif
+ 
  #endif /* _SUEXEC_H */