Hi,
this is also a followup to Justin Grindea and "clamav perl scrip and su_e=
xec".
We faced the same problem and considered it a design error for an upload =
approve
script to be called using suEXEC for these two reasons:
1. suEXEC executes CGIs as different users, which might =20
not have access to the uploaded files (which are usually =20
in /tmp and owned by www-data:www-data, permissions 600) =20
=20
2. suEXEC check 18, "Is the target user/group the same as =20
the program's user/group?" means for us that we would need =20
as many upload approve scripts as virtual hosts, each =20
owned by the user the respective virtual host runs his =20
CGIs under. =20
The solution in the attached patch is to avoid ap_call_exec() using suEXE=
C.
Most likely, soemone with more experience in apache programming can boil =
this
patch down to the essentials. It runs on our test system as intended, but=
we
didn't put it into production use yet. It would be nice to get some feedb=
ack first.
The patch is against mod_security.c of the apache1 directory of the curre=
nt
1.9.1 release of mod_security.
Kindest regards,
Michael Bunk
-----------------------------------------
Gesendet mit Computer Leipzig - WebMail
http://www.computer-leipzig.de
|
