Re: [mod-security-users] @inspectFile script does not write to files

[Christian F. <chr...@ne...>]

Hey Thorsten,

I can't confirm. I'm getting the tmp file as expected.

Do you have permissions restricting the www-data user from writing to /tmp?

The next thing I would do is calling apache via 
$> strace httpd -X 
and then look for the write operation. (Did not do this myself, but I reckon
is should be visible).

Ahoj,

Christian

On Tue, Oct 02, 2018 at 08:05:29PM +0200, Thorsten Kampe wrote:
> Hi,
> 
> I have a script that inspects files for viruses (like in "Inspecting 
> Files" from https://www.feistyduck.com/library/modsecurity%
> 2dhandbook%2dfree/online/ch04-logging.html).
> 
> This script works fine - although any file that I want to write to or 
> create from this script is neither created nor modified.
> 
> See this simple example script:
> 
> ###
> #! /usr/bin/env bash
> 
> touch /tmp/MODSECURITY-WAS-HERE.txt
> 
> printf '0 THREAD DETECTED\n'
> ###
> 
> This scripts denies all Uploads via Apache but no file "MODSECURITY-
> WAS-HERE.txt" is created.
> 
> This are the relevant lines from modsecurity.conf
> ### (line break in line 2)
> SecRuleEngine On
> 
> SecTmpSaveUploadedFiles On
> 
> SecRule FILES_TMPNAMES "@inspectFile /opt/sophos-av/runav.sh" 
> "id:'1',log,auditlog,deny,severity:2,phase:2,t:none"
> ###
> 
> This is mod-security 2.9.2 on Ubuntu 18.04.
> 
> 
> Thorsten
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/