suexec support for FrontPage Extentions

suexec support for FrontPage Extentions

Post by Scot W. Hetze » Tue, 19 May 1998 04:00:00



Could one of the suexec maintainers look over the following patches for
suexec.h & suexec.c.

What the bellow patches do is it performs all of the checks up to and
including the setgid to target group check.  Then we check the if the
command (cmd) that needs to be executed is not FPEXE, before we continue
with the remainder of the checks (current working directory, doc root info,
cmd location, .., etc), before execution.  If the cmd is FPEXE then we by
pass the remainder of the checks, and execute it.

The reason we have to bypass before getting the current working directory is
because "getcwd" is unable to obtain the cwd for FPEXE, due to the
permissions set on the apache-fp directory:

../frontpage/vsersion3.0/
drwx--x--x  3 root  bin    512 May  5 11:51 apache-fp

../frontpage/vsersion3.0/apache-fp
dr-xr-xr-x  2 root  bin     512 Mar  5 06:00 _vti_bin

../frontpage/vsersion3.0/apache-fp/_vti_bin
-rwsr-xr-x  1 root  bin  233943 Mar  5 06:00 fpexe

NOTE:  We change to the UID & GID of the target before we run FPEXE, so that
we don't end up executing it as root.

Scot

*** support/suexec.h.orig Sat May 10 00:06:17 1997
--- support/suexec.h Thu Apr 23 15:57:52 1998
***************
*** 50,55 ****
--- 50,62 ----
   *
   */

+ /* "FPEXE modification made on Nov 2nd 1997 by Mark Wormgoor
(ridd...@ipe.nl)
+  *
+  * Changes were made in order to use Suexec and Frontpage 98 at the same
time.
+  * Instead of trying to run suid on
/usr/local/frontpage/currentversion/bin/fpexe,
+  * we execute this so the suid-bit does all the work
+  */
+
  /*
   * suexec.h -- user-definable variables for the suexec wrapper code.
   */
***************
*** 121,129 ****
--- 128,162 ----
   * DOC_ROOT -- Define as the DocumentRoot set for Apache.  This
   *             will be the only hierarchy (aside from UserDirs)
   *             that can be used for suEXEC behavior.
+  *             This is not used, since we have VirtualHosts defined.
   */
  #ifndef DOC_ROOT
! #define DOC_ROOT "/usr/local/etc/httpd/htdocs"
! #endif
!
! /*
!  * FPEXE
!  * FRONTPAGE_EXE -- We are running frontpage and we don't need to run
!  *                  fpexe suid, since it's already set suid.  Also, the
!  *                  dir-rights are incorrect and so on...
!  */
! #ifndef FPEXE
! #define FPEXE "fpexe"
! #endif
!
! #ifndef FRONTPAGE_EXE
! #define FRONTPAGE_EXE
"/usr/local/frontpage/version3.0/apache-fp/_vti_bin/fpexe"
! #endif
!
! /*
!  * SYSTEM_CGI -- Define as the cgi directory for system-wide CGI's
!  *               Note that UID/GID of the cgi or the directory are
!  *   NOT matched if they're in this directory, although
!  *   all the other checks still apply. Caveat Emptor.
!  */
!
! #ifndef SYSTEM_CGI
! #define SYSTEM_CGI "/usr/local/www/cgi-bin"
  #endif

  /*

*** support/suexec.c.orig Fri Jan 30 08:45:44 1998
--- support/suexec.c Fri Apr 24 17:32:21 1998
***************
*** 66,71 ****
--- 66,94 ----
   *
   */

+ /*
+  * "System" CGI modification 97.05.10 by Rick Franchuk
(ri...@netnation.com)
+  *
+  * I found that while it's great to make scripts run under the UID and GID
+  * specified in httpd.conf or what /etc/passwd says is 'cool', suEXEC can
+  * really put a damper on 'System' cgi's, forcing copies of the scripts
+  * to be installed into users' home directories. That didn't seem very
+  * fitting... so I changed it so that the target UID check is disabled in
+  * a system directory #defined in suexec+.h. I hope you all find it
useful.
+  *
+  * The docroot check had to be bypassed to allow functionality for
VirtualHost
+  * entries. I'm somewhat suprised noone encountered that behavior before.
+  */
+
+ /* "FPEXE modification made on 98.04.24 by Scot Hetzel
(hetz...@westbend.net)
+  * based on previous FPEXE modifications supplied by Mark Wormgoor
+  * (ridd...@ipe.nl)
+  *
+  * Changes were made in order to use Suexec and Frontpage 98 at the same
time.
+  * After we change to the target_uid and target_gid.  We check if cmd =
FPEXE,
+  * if it does then we execute the cmd without performing any further
tests.
+  *
+  */

  #include "suexec.h"

***************
*** 75,81 ****
  #include <sys/types.h>
  #include <stdio.h>
  #include <stdarg.h>
! #include <string.h>
  #include <pwd.h>
  #include <grp.h>
  #include <time.h>
--- 98,104 ----
  #include <sys/types.h>
  #include <stdio.h>
  #include <stdarg.h>
! #include <strings.h>
  #include <pwd.h>
  #include <grp.h>
  #include <time.h>
***************
*** 138,144 ****

  static void err_output(const char *fmt, va_list ap)
  {
- #ifdef LOG_EXEC
      time_t timevar;
      struct tm *lt;

--- 161,166 ----
***************
*** 158,164 ****
      vfprintf(log, fmt, ap);

      fflush(log);
- #endif /* LOG_EXEC */
      return;
  }

--- 180,185 ----
***************
*** 264,270 ****
   log_err("user mismatch (%s)\n", pw->pw_name);
   exit(103);
      }
!
      /*
       * Check for a leading '/' (absolute path) in the command to be
executed,
       * or attempts to back up out of the current directory,
--- 285,291 ----
   log_err("user mismatch (%s)\n", pw->pw_name);
   exit(103);
      }
!
      /*
       * Check for a leading '/' (absolute path) in the command to be
executed,
       * or attempts to back up out of the current directory,
***************
*** 301,306 ****
--- 322,328 ----
      /*
       * Error out if the target group name is invalid.
       */
+
      if (strspn(target_gname, "1234567890") != strlen(target_gname)) {
   if ((gr = getgrnam(target_gname)) == NULL) {
       log_err("invalid target group name: (%s)\n", target_gname);
***************
*** 325,331 ****
       * Log the transaction here to be sure we have an open log
       * before we setuid().
       */
!     log_err("uid: (%s/%s) gid: (%s/%s) %s\n",
               target_uname, actual_uname,
               target_gname, actual_gname,
               cmd);
--- 347,353 ----
       * Log the transaction here to be sure we have an open log
       * before we setuid().
       */
!     log_err("uid: (%s/%s) gid: (%s/%s) cmd: %s\n",
               target_uname, actual_uname,
               target_gname, actual_gname,
               cmd);
***************
*** 357,363 ****
       * and setgid() to the target group. If unsuccessful, error out.
       */
      if (((setgid(gid)) != 0) || (initgroups(actual_uname,gid) != 0)) {
!         log_err("failed to setgid (%ld: %s)\n", gid, cmd);
          exit(109);
      }

--- 379,385 ----
       * and setgid() to the target group. If unsuccessful, error out.
       */
      if (((setgid(gid)) != 0) || (initgroups(actual_uname,gid) != 0)) {
!         log_err("failed to setgid (%ld: %s/%s)\n", gid, cwd, cmd);
          exit(109);
      }

***************
*** 365,375 ****
       * setuid() to the target user.  Error out on fail.
       */
      if ((setuid(uid)) != 0) {
!  log_err("failed to setuid (%ld: %s)\n", uid, cmd);
   exit(110);
      }

      /*
       * Get the current working directory, as well as the proper
       * document root (dependant upon whether or not it is a
       * ~userdir request).  Error out if we cannot get either one,
--- 387,405 ----
       * setuid() to the target user.  Error out on fail.
       */
      if ((setuid(uid)) != 0) {
!  log_err("failed to setuid (%ld: %s/%s)\n", uid, cwd, cmd);
   exit(110);
      }

      /*
+      * We logged everything, changed to the target uid/gid, and know the
+      * user is ok.  We run fpexe now and bail out before anything goes
wrong.
+      */
+ #ifdef FPEXE
+     if ((strcmp(cmd, FPEXE)) != NULL) {
+ #endif
+
+     /*
       * Get the current working directory, as well as the proper
       * document root (dependant upon whether or not it is a
       * ~userdir request).  Error out if we cannot get either one,
***************
*** 402,411 ****
--- 432,446 ----
          }
      }

+     /*
+      * This section must be commented out to work properly with
+      * VirtualHosts running CGI in thier own directories.
+      *
      if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
          log_err("command not in docroot (%s/%s)\n", cwd, cmd);
          exit(114);
      }
+      */

      /*
       * Stat the cwd and verify it is a directory, or error out.
***************
*** 451,470 ****
       * Error out if the target name/group is different from
       * the name/group of the cwd or the program.
       */
!     if ((uid != dir_info.st_uid) ||
!  (gid != dir_info.st_gid) ||
!  (uid != prg_info.st_uid) ||
!  (gid != prg_info.st_gid))
!     {
!  log_err("target uid/gid (%ld/%ld) mismatch with directory (%ld/%ld) or
program (%ld/%ld)\n",
!    uid, gid,
!    dir_info.st_uid, dir_info.st_gid,
!    prg_info.st_uid, prg_info.st_gid);
!  exit(120);
      }

      clean_env();

      /*
       * Be sure to close the log file so the CGI can't
       * mess with it.  If the exec fails, it will be reopened
--- 486,516 ----
       * Error out if the target name/group is different from
       * the name/group of the cwd or the program.
       */
!
! #ifdef SYSTEM_CGI
!     if (strncmp(cwd, SYSTEM_CGI, strlen(SYSTEM_CGI))) {
! #endif
!  if ((uid != dir_info.st_uid) ||
!      (gid != dir_info.st_gid) ||
!      (uid != prg_info.st_uid) ||
!      (gid != prg_info.st_gid))
!  {
!      log_err("target uid/gid (%ld/%ld) mismatch with directory %s(%ld/%ld)
or program %s(%ld/%ld)\n",
!   uid, gid,
!   cwd, dir_info.st_uid, dir_info.st_gid,
!   cmd, prg_info.st_uid, prg_info.st_gid);
!      exit(120);
!  }
! #ifdef SYSTEM_CGI
      }
+ #endif

      clean_env();

+ #ifdef FPEXE
+     }
+ #endif
+
      /*
       * Be sure to close the log file so the CGI can't
       * mess with it.  If the exec fails, it will be reopened
***************
*** 486,491 ****
--- 532,538 ----
       *
       * Oh well, log the failure and error out.
       */
+
      log_err("exec failed (%s)\n", cmd);
      exit(255);
  }

 
 
 

1. FrontPage extentions on apachee linux

 Hello,

I just tried to install the frontpage extention (2.0 beta) on my linux box
running apache 1.1.1. The install went fine, but frontpage reported an error
when I tried to create a new web.
Here is the apache's log:

sicel-home-1-25.urbanet.ch - - [17/Nov/1996:00:40:06 +0100] "POST /julien/_vti_bin/_vti_aut/author.exe HTTP/1.0" 401 -
sicel-home-1-25.urbanet.ch - jmercay [17/Nov/1996:00:40:07 +0100] "POST /julien/_vti_bin/_vti_aut/author.exe HTTP/1.0" 501 -

The first line is the request for autentification. But the second is unknown
to me (501 - Not Implemented)
Why apache said POST not implemented ? It said 501 only with author.exe; other
cgi program from the fp extention seem to work fine (no errors at least).

Can someone help me ?

Thank in advance,
Julien

2. linux driver wtih STREAMS system

3. Frontpage Extentions Package?

4. hangcheck-timer

5. Apache 1.2.5 and frontpage extentions

6. help with script

7. Microsoft FrontPage, Linux Extentions

8. What came with Linux?

9. Frontpage extentions on Apache

10. Frontpage extentions

11. Frontpage Server Extention and FreeBSD

12. Frontpage extentions

13. Microsoft Frontpage Extention to FreeBSD