#528062 apache2: mod_userdir is broken with respect to suexec support. patch included

Package:
apache2
Source:
apache2
Description:
Apache HTTP Server
Submitter:
"Witold Baryluk"
Date:
2021-12-15 09:03:05 UTC
Severity:
normal
Tags:
#528062#5
Date:
2009-05-10 15:47:01 UTC
From:
To:
Hi,

on one of my production system I'm using ldap_userdir which borrowed code
from mod_userdir. After some investigation (suexec support was naccassary)
that there is error in suexec handling, and it existed many years unnoticed.

Hopefully mod-ldap-userdir author accepted my patches (about request notes,
and some bad usage of strtoul) and everything works out of box on lenny now.


Bud bad code in mod_userdir still exists.

I'm attaching the patch for mod_userdir.c. (based on patch for mod_ldap_userdir.c)

It was tested and works correctly. Please apply and notify upstream if possible.

Thanks you.

#528062#10
Date:
2009-05-10 17:43:44 UTC
From:
To:

Thanks for your patch. Please be a bit more verbose on what the actual
problem was and how it can be reproduced.

Stefan

#528062#15
Date:
2009-05-10 19:04:49 UTC
From:
To:
Dnia 2009-05-10, nie o godzinie 19:43 +0200, Stefan Fritsch pisze:

I will try provide simple example, but actually suexec configuration
isn't simple.

I have apache2 configured with mod_userdir + mod_suexec + mod_fcgid (for
runing php5-cgi in my case).


According to http://httpd.apache.org/docs/2.2/suexec.html#usage
handling of /~baryluk/ should automagically work (by working, I mean fcgid scripts
are run under uid baryluk).

Currently this scripts are run under the www-data uid, because
as I first written mod_userdir.c is not working correctly (not to be honest,
not well tested - this error is sitting there very very long).

There is also some comments in patch. Author of mod_ldap_userdir.c can
also help, but first ask me about any problems. We don't need to bother
him. ;)

Hope this will help.

#528062#20
Date:
2009-05-29 12:43:01 UTC
From:
To:
Dnia 2009-05-10, nie o godzinie 19:43 +0200, Stefan Fritsch pisze:


Here is my exact (i hope) configuration attached:

# apt-get install apache2 apache2-suexec libapache2-mod-fcgid php5-cgi
# a2enmod actions suexec userdir fcgid

Relevant files in attachment

/etc/apache2/sites-available/default
/etc/apache2/conf.d/php-fcgid.conf

/home/baryluk/public_html/test.php
/home/baryluk/public_html/fcgi-bin/php-fcgi-wrapper
/home/baryluk/public_html/.htaccess
(edit the last one if other username needed)

# chown -R baryluk:users /home/baryluk/public_html

# /etc/init.d/apache2 restart

Then point your web browser to http://servername/~baryluk/test.php

You will see, `whoami` output one the first line. It will say
"www-data", but should say "baryluk".

This simply mean that suexec support in userdir is not working
correctly.


Patch in first post resolves this problem. There was identical problem
in ldap-userdir, but is already solved there in the same way.

#528062#27
Date:
2009-10-19 19:05:26 UTC
From:
To:
Hi,

is anybody wanting to review my patches?


They are really simple. And without them half of functionality
of suexec is not existing. And it doesn't agree at all with documentation
of Apache http://httpd.apache.org/docs/2.2/suexec.html#usage
subsection "User directories".

#528062#32
Date:
2010-07-19 14:46:28 UTC
From:
To:
Hello,

I am getting a bit disenchanted with Debian BTS thanks to this bug. How
much easier could Witold have made it?

He described the bug, submitted a patch. A year later, I'm still having
to use his patch to run my Apache. Have we gone 12 years back in time?
Is patching and compiling now a required skill for Debian users? I
thought we left that behind with Potato.

Regards, Michal

#528062#37
Date:
2010-07-22 21:01:08 UTC
From:
To:
tags 528062 +patch
thanks

Sorry, this has somehow fallen through the cracks. I will try to get
it fixed before squeeze is released.

#528062#44
Date:
2010-07-24 20:12:28 UTC
From:
To:
I suspect that the patch would break suexec for mod_include's exec
subrequests, but haven't tested it yet. Maybe the note needs to be set
both on the main and the sub request.

#528062#49
Date:
2010-10-19 15:53:53 UTC
From:
To:
  Hi,

I tested the patch for a Lenny server with quite some public_html
UserDirs - I suspect that my observations also apply to Squeeze.

The behavior of our configuration with the default Apache packages is
that normal CGI scripts in public_html dirs are running under the owners
uid, while php scripts are executed as www-data. We don't use fcgid.
Our desired behavior would be that CGI scripts as well as PHP scripts
run under the owners uid. This can be quite easily setup with suphp, but
a solution that only requires suexec would be nice.

With the supplied patch PHP scripts are run under the owners uid *if and
only if* the php binary is copied to every public_html dir that contains
php scripts, symlinking does not seem to work here.
Also mod_action has to be configured correctly (which I did not figure
out yet for *many* userdirs).

Without further action the patch completely breaks PHP script execution
(Error 500) beneath user dirs when suexec is enabled.

IMHO it is far from production ready. For only few different users it is
rather simple to set up different vhosts with explicit SuexecUserGroup
configs that will give you the same results.

Just my ¢ 2,
     Christopher

#528062#54
Date:
2011-01-23 01:32:03 UTC
From:
To:
It do not need to be copied. I would not even advise this as it will be problematic
due to the disk usage, cache usage and problems with php upgrades.


It is sufficient to create 2 line shell script (as ~/public_html/fcgi-bin/php-fcgi-wrapper)

#!/bin/sh
exec /usr/bin/php5-cgi

It is needed becuase of suexec behaviour of running only fcgi scripts being owned by user,
and being in proper subdirectory. I already given this wrapper in message #20, as php-fcgi-wrapper.
There is nothing unsafe in this file being editable by user, it will be anyway started
with rights of user, and nothing beyond what already can be broken in normal php will be broken.
(like starting other programs or deleting files).

I would not say this breaks suexec. It actually makes suexec work as described in Apache documentation.


Also mod_action beheaves in normal way. This is setuped using per directory .htaccess,
for exaempl "Action php-fcgi /~baryluk/fcgi-bin/php-fcgi-wrapper".
It is also safe to make this file user-editable. It can be owned by somebody else
if one really need, or written directly in main configuration file (nested in proper Directory section),
or upper in directory hierarchy. It will not break anything.

I have currently .htaccess in each individual public_html dir of each user
which want to have php. The problem you state, is like saying to express:

For each php handler with url matchinng "^/~([^/]+)/", use "/~$1/fcgi-bin/php-fcgi-wrapper" as Action.

IMHO problem that this is not supported, is problem with mod_actions module, not this patch.
I have about 200 users, of which about 50 have PHP enabled.
What is even nicer in this (IMHO correct) behaviour after applying patch,
is that user can enable/disable php without administrator.
Similar one can for example change version of php if he/she whishes.
(one can disable this behaviour by disabling htaccess processing,
or disabling overriding Actions in per-directory htaccess).

For simplicity I just have /etc/skel/public_html/.htaccess with proper Action line,
which is comented out, and additional comment what it is, and when it should be comented out.
Similary in /etc/skel/public_html/cgi-bin/php5-fcgi-wrapper i have above script
(with commented exec and comment that it should uncommented if one wishes PHP).
This makes all new users have this files. For old users I copied this files
using simple script.

BTW. I have disabled php by default as additional security precaution.
But one can of course enable it by default, and it will by still good.
In my opinion it is not true. It is just a way suexec works.
You need to configure it carefully becuase it is very strict.
This is also the reason i provided step-by-step detailed configuration
(on clean setup with patch).

According to the suexec documentation the behaviour of patch is correct.
(or maybe you are talking about some other way of exeuting php script?
like mod_php or other form of cgi of suphp, etc).

Thanks for your comments!

It is possible. But I do not use includes, and do knot know how exactly they works.
I reported this problem with patch on Apache bugzilla, but nobody from developers
responds. :(

Bug entry is here https://issues.apache.org/bugzilla/show_bug.cgi?id=49439

PS. Exact configuration can be also found on https://issues.apache.org/bugzilla/show_bug.cgi?id=49439#c6

#528062#59
Date:
2011-12-18 18:12:05 UTC
From:
To:
tags 528062 -patch
forwarded 528062
https://issues.apache.org/bugzilla/show_bug.cgi?id=49439
thanks

As discussed in the upstream bug report, it is far from clear that
your patch does not break other things or cause wrong behavior with
other configurations. Therefore I am removing the patch tag.

Further discussion should happen in the upstream report.

#528062#68
Date:
2017-01-25 04:02:00 UTC
From:
To:
Dear sir,

Fyi we got an instruction from our client to contact you on the above
subject, please kindly take into quick consideration the attached shipping
documents before we proceed with shipment.

Kindly confirm that the details are correct and revert back to us asap

Regards
Shipping agent
Wan Hai Lines co.,ltd
600 minsheng road shanghai 200135 china
Tel:(86)-(21)-58834638
Fax:(86)-(21)-58832073
Zip code:200135

#528062#73
Date:
2017-01-25 04:04:03 UTC
From:
To:
Dear sir,

Fyi we got an instruction from our client to contact you on the above
subject, please kindly take into quick consideration the attached shipping
documents before we proceed with shipment.

Kindly confirm that the details are correct and revert back to us asap

Regards
Shipping agent
Wan Hai Lines co.,ltd
600 minsheng road shanghai 200135 china
Tel:(86)-(21)-58834638
Fax:(86)-(21)-58832073
Zip code:200135

#528062#80
Date:
2019-06-17 07:38:34 UTC
From:
To:
Hello,

Our partners referred your company to us. Regarding your great products.
Please see required products, quantity and specifications as attached.

Kindly give us your lowest possible prices for FCL shipment.


Best Regards,

Wanda Rodriguez
Purchase Assistant

Hidroconta Trading Ltd.
Av. de Sta. Catalina,
60, 30012 Murcia, Spain
Phone: +34 968 26 77 66
Fax: +34 968 26 77 06

#528062#85
Date:
2019-11-10 00:18:38 UTC
From:
To:
Good day,

My associate from China wants to discuss a business investment deal with
you. I awaiting your response to enable us discuss about this business
investment

Nael M. Al Homoud
Executive Director & High Investment Committee Member@
The Arab Investment Co
www.taic.com [1]



Links:
------
[1] http://www.taic.com

#528062#92
Date:
2021-09-24 07:35:21 UTC
From:
To:
Dzień dobry,

kontaktuję się z Państwem, ponieważ dostrzegam możliwość redukcji opłat za prąd.

Odpowiednio dobrana instalacja fotowoltaiczna to rozwiązanie, które pozwala wygenerować spore oszczędności w skali roku.

Chciałbym porozmawiać z Państwem o tego typu rozwiązaniu, a także przedstawić wstępne kalkulacje.

Czy są Państwo zainteresowani?

Pozdrawiam,
Dorian Kwiatkowski

#528062#97
Date:
2021-10-14 07:36:04 UTC
From:
To:
Dzień dobry,

jakiś czas temu zgłosiła się do nas firma, której strona internetowa nie pozycjonowała się wysoko w wyszukiwarce Google.

Na podstawie wykonanego przez nas audytu SEO zoptymalizowaliśmy treści na stronie pod kątem wcześniej opracowanych słów kluczowych. Nasz wewnętrzny system codziennie analizuje prawidłowe działanie witryny.  Dzięki indywidualnej strategii, firma zdobywa coraz więcej Klientów.

Czy chcieliby Państwo zwiększyć liczbę osób odwiedzających stronę internetową firmy? Mógłbym przedstawić ofertę?


Pozdrawiam serdecznie,
Patryk Górecki

#528062#102
Date:
2021-10-20 07:40:40 UTC
From:
To:
Dzień dobry,

jakiś czas temu zgłosiła się do nas firma, której strona internetowa nie pozycjonowała się wysoko w wyszukiwarce Google.

Na podstawie wykonanego przez nas audytu SEO zoptymalizowaliśmy treści na stronie pod kątem wcześniej opracowanych słów kluczowych. Nasz wewnętrzny system codziennie analizuje prawidłowe działanie witryny.  Dzięki indywidualnej strategii, firma zdobywa coraz więcej Klientów.

Czy chcieliby Państwo zwiększyć liczbę osób odwiedzających stronę internetową firmy? Mógłbym przedstawić ofertę?


Pozdrawiam serdecznie,
Patryk Górecki

#528062#107
Date:
2021-11-08 08:51:11 UTC
From:
To:
Dzień dobry!

Czy mógłbym przedstawić rozwiązanie, które umożliwia monitoring każdego auta w czasie rzeczywistym w tym jego pozycję, zużycie paliwa i przebieg?

Dodatkowo nasze narzędzie minimalizuje koszty utrzymania samochodów, skraca czas przejazdów, a także tworzenie planu tras czy dostaw.

Z naszej wiedzy i doświadczenia korzysta już ponad 49 tys. Klientów. Monitorujemy 809 000 pojazdów na całym świecie, co jest naszą najlepszą wizytówką.

Bardzo proszę o e-maila zwrotnego, jeśli moglibyśmy wspólnie omówić potencjał wykorzystania takiego rozwiązania w Państwa firmie.


Z poważaniem,
Dawid Rowicki

#528062#112
Date:
2021-11-18 08:58:30 UTC
From:
To:
Dzień dobry,

czy interesuje Państwa wymiana niezapłaconych przez Klientów faktur na gotówkę?

Pomagamy wszystkim przedsiębiorcom, którzy szukają gwarancji bezpieczeństwa i płynności finansowej.

Jeśli są Państwo otwarci na wstępną rozmowę w tym temacie proszę o odpowiedź.


Pozdrawiam,
Adrian Ostojski
Dyrektor Finansowy

#528062#117
Date:
2021-12-15 08:40:38 UTC
From:
To:
Dzień dobry,

zapoznałem się z Państwa ofertą i z przyjemnością przyznaję, że przyciąga uwagę i zachęca do dalszych rozmów.

Pomyślałem, że może mógłbym mieć swój wkład w Państwa rozwój i pomóc dotrzeć z tą ofertą do większego grona odbiorców. Pozycjonuję strony www, dzięki czemu generują świetny ruch w sieci.

Możemy porozmawiać w najbliższym czasie?


Pozdrawiam
Adam Furgalski