About this list Date view Thread view Subject view Author view Attachment view

From: Lars Braeuer (lbraeuer_at_mpex.net)
Date: Sat 09 Nov 2002 - 17:50:07 GMT


is this just my fault or does "vserver <name> exec" remark that it's
run by a root suidperl script?
the interpreter used is suidperl (both script and suidperl executable
are mode 4755 / owner root.root).

here's the test script I'm using:

--snip-------------------------
#!/usr/bin/suidperl -T

## Security, clean up ENV ##
$ENV{'PATH'} = '/bin:/usr/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};

$who = `whoami`;
print "Script running as: $who\n";

$exec = `/usr/sbin/vserver server1 exec whoami 2>&1`;
print "Exec output:\n$exec\n";

$t = `touch testfile`;
--/snap-------------------------

-rwsr-xr-x 2 root root 800943 Mar 23 2002 /usr/bin/suidperl*
-rws--s--x 1 root root 315 Nov 9 18:36 test.cgi*
-rw-r--r-- 1 root root 0 Nov 9 18:44 testfile

the output of the script, when run by a standard user:
--snip-------------------------
Script running as: root

Exec output:
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
SIOCSIFNETMASK: Permission denied
SIOCSIFBRDADDR: Permission denied
SIOCSIFFLAGS: Permission denied
/usr/lib/vserver/save_s_context: /var/run/vservers/customers.ctx:
Permission denied
Can't chroot to directory . (Operation not permitted)
--/snap-------------------------

the file "testfile" created using "touch" is user root group root.
when executing the script on the shell as root, it works, so the vserver
command doesn't seem to be executed as root.

is suidperl the problem? or is there something else to be checked/changed?

any suggestions and/or solutions are very welcome. ;)

lars


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 09 Nov 2002 - 19:15:00 GMT by hypermail 2.1.3