Re: mod_env/5680: SetEnv directive has no effect

[sl...@apache.org]

[In order for any reply to be added to the PR database, you need]
[to include <ap...@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or      ]
["Re: general/1098:").  If the subject doesn't match this       ]
[pattern, your message will be misfiled and ignored.  The       ]
["apbugs" address is not added to the Cc line of messages from  ]
[the database automatically because of the potential for mail   ]
[loops.  If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request from a  ]
[developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]


Synopsis: SetEnv directive has no effect

State-Changed-From-To: open-closed
State-Changed-By: slive
State-Changed-When: Sun Sep 17 20:08:49 PDT 2000
State-Changed-Why:
suexec cleans the environment down to a 
small set of "safe" variables for security
reasons.  If you are using suexec,
you cann't pass arbitrary env variables
to CGI scripts.
Thanks for using Apache.

Re: mod_env/5680: SetEnv directive has no effect

[Joshua Slive <sl...@apache.org>]

On Sun, 17 Sep 2000, Chris Hardie wrote:

> 
> Two followup queries, then:
> 
> -It seems as though someone who has the privileges to modify the server
> configuration and restart the server would also be able to disable/enable
> the suexec protections.  Doesn't it seem logical that the SetEnv calls in
> the conf file could be considered "safe" and should still be passed
> through?  (It does to me, I'm happy to hear about why this might violate
> suexec's security model.)

suexec is a separate program and it has no way to communicate with 
apache about which variables are "safe" and which aren't.

> 
> -It would have been helpful to have this behavior documented somewhere,
> either in the suexec docs or in the SetEnv description; I was debugging
> that thing for days.  It would also be cool to document how to recompile
> suexec with a new list of safe variables (with the usual caveats).
> 

Yes, sometimes the format of the suexec docs can be a little confusing.
It is documented, however.  See "19. Can we successfully clean the process
environment to ensure safe operations?".  If you look at
src/support/suexec.c, you will see the array
safe_env_lst[] near the top which can be easily edited.

Overall, suexec is not designed to be flexible and easy to use.  It is
designed to be simple and safe.

Re: mod_env/5680: SetEnv directive has no effect

[Chris Hardie <ch...@summersault.com>]

Two followup queries, then:

-It seems as though someone who has the privileges to modify the server
configuration and restart the server would also be able to disable/enable
the suexec protections.  Doesn't it seem logical that the SetEnv calls in
the conf file could be considered "safe" and should still be passed
through?  (It does to me, I'm happy to hear about why this might violate
suexec's security model.)

-It would have been helpful to have this behavior documented somewhere,
either in the suexec docs or in the SetEnv description; I was debugging
that thing for days.  It would also be cool to document how to recompile
suexec with a new list of safe variables (with the usual caveats).

Thanks,
Chris

On 18 Sep 2000 slive@apache.org wrote:

> suexec cleans the environment down to a 
> small set of "safe" variables for security
> reasons.  If you are using suexec,
> you cann't pass arbitrary env variables
> to CGI scripts.
> Thanks for using Apache.