php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27051 Impersonation with FastCGI does not EXEC process as impersonated user
Submitted: 2004-01-26 15:41 UTC Modified: 2013-08-15 11:56 UTC
Votes:31
Avg. Score:4.6 ± 0.8
Reproduced:27 of 27 (100.0%)
Same Version:10 (37.0%)
Same OS:19 (70.4%)
From: ghoffer at globalscape dot com Assigned: pajoye
Status: Assigned Package: CGI/CLI related
PHP Version: 5.3 OS: Windows
Private report: No CVE-ID:
Have you experienced this issue?
Rate the importance of this bug to you:

 [2004-01-26 15:41 UTC] ghoffer at globalscape dot com
Description:
------------
(Related to Bug #10065, but slightly different and more detailed )
Environment:  
Win2K3 running PHP 4.3.4 under FastCGI.  PHP.INI has "fastcgi.impersonate=1".  IIS Site has "Anonymous Access" OFF and "NT Authentication" ON (so that you have to log in to the site as an NT User).
Up to this point, all is fine: the NT user is being impersonated by the main thread of PHP so that file access permissions are handled properly.

HOWEVER, if the PHP script attempts to execute a command (using exec, or passthru, or similar) then that spawned process is NOT impersonating the NT account, but rather running under the IIS account.

SUGGESTED RESOLUTION: in proc_open.c, the proc_open function can make a few calls in lieu of "CreateProcess" in order to "pass along" the Impersonation.  Instead of CreateProcess, it should use "CreateProcessAsUser," passing in the token of the impersonated user (which PHP is running under).  If it does not do this, per the Win32 API docs, CreateProcess simply uses the non-impersonated token.

Here is how to run a spawned process as the impersonated user (which CAN be done conditionally when impersonation is necessary (e.g., "LOGON_USER" is defined; but doing it ALWAYS should in no way impair security, only a slight hit in performance as three additional API calls are made):
[ Error checking and variable declarations omitted ]

   OpenThreadToken( GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken );  // get impersonation token
   DuplicateTokenEx( hToken, MAXIMUM_ALLOWED, &sa, SecurityImpersonation, TokenPrimary, &hToken2 ); // duplicate it for passing to CreateProcessAsUser
   CreateProcessAsUser( hToken2, ... ) // rest of params are the same as CreateProcess
   // . . . 
   CloseHandle( hToken2 );
   CloseHandle( hToken );


Reproduce code:
---------------
<?php
  # run this under FastCGI (with "fastcgi.impersonate=1" in PHP.INI
  # with NT Auth access to the Virtual Site / Dir that houses the script.
  # DOIT.bat can be any batch file.  For example, have the batch file attempt to write a new file to a folder that
  # has ONLY write permissions for the logged-inNT User, NOT the IWAM account.
  # It will fail because cmd.exe is being executed as IWAM_* even though
  # we logged into the website and properly impersonated another user.
  $last_line = @exec("cmd.exe /c doit.bat");
?>

Expected result:
----------------
PHP running as impersonated user under FastCGI should spawn processes with security context of that impersonated user.

Actual result:
--------------
The spawned process is being executed in the security context of the IIS account (IWAM_*).

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-06-21 18:06 UTC] aheckmann at m-s dot de
I have the same problem here. Has anything happens in the last three years on that feature request? The solution seems to be easy, or not?
 [2008-12-08 23:04 UTC] louis at steelbytes dot com
please please please fix/add this.

it is killing me with 5.2.6 / win2008.
 [2008-12-09 00:45 UTC] louis at steelbytes dot com
I've added a new function to my now inappropriately named 'PHP_Filetimes' http://www.steelbytes.com/?mid=46 (use the *beta* download)

The new function is a simple wrapper for CreateProcessAsUser that deals with this problem.

come on PHP/Zend pull ya socks up, I shouldn't have to write my own extensions to work around such 'bugs'/limitations :-)
 [2009-06-24 15:12 UTC] tgross at m-s dot de
When will this bug be fixed?

I compiled PHP myself an added the fix that ghoffer submitted. The fix works, so would you please add these few lines into PHP?

It's a big problem on our servers that impersonation does not work correctly.
 [2009-08-27 19:17 UTC] nathan at andersonsplace dot net
Please note this is still occurring in PHP 5.2 branch.
 [2009-08-27 22:20 UTC] pajoye@php.net
Assigned to me so it will stay in my radar. I can see the src of the bug.
 [2009-09-01 22:51 UTC] svn@php.net
Automatic comment from SVN on behalf of pajoye
Revision: http://svn.php.net/viewvc/?view=revision&revision=287954
Log: - #27051, create process as impersonated user
 [2009-09-01 22:51 UTC] pajoye@php.net
Please try using this snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2009-09-02 01:59 UTC] svn@php.net
Automatic comment from SVN on behalf of pajoye
Revision: http://svn.php.net/viewvc/?view=revision&revision=287958
Log: - #27051, we need the thread token here, not the process
 [2009-09-03 15:52 UTC] benadler at gmx dot net
I updated to php-5.3-nts-win32-VC9-x86-latest.zip yesterday night. The impersonation problem with iis6 and fastcgi was fixed, but when starting a php-script from the command line/dosbox, I get:

Warning: exec(): Unable to fork [imconvert.exe ...] in scriptname.php on line X

Using exec() works fine when the scripts are called from IIS, though. The failing scripts have worked fine before updating php.

I traced the execution using sysinternals process monitor, and

Process Create
C:\WINDOWS\system32\cmd.exe
cmd.exe /c "imconvert "tif:D:/data/foo.tif[0]" "D:/data/bar.jpg""

shows SUCCESS, but it seems imconvert.exe is never started, as it doesn't show up in the trace. Process Monitor shows that the php script is running as the user who's currently logged in, but I cannot see which user is trying to start convert.exe

Can I help with more info?

ben.
 [2009-09-03 19:16 UTC] svn@php.net
Automatic comment from SVN on behalf of pajoye
Revision: http://svn.php.net/viewvc/?view=revision&revision=288003
Log: - #27051, improve fix on xp/2k3
 [2009-09-03 19:16 UTC] svn@php.net
Automatic comment from SVN on behalf of pajoye
Revision: http://svn.php.net/viewvc/?view=revision&revision=288004
Log: - #27051, improve fix on xp/2k3
 [2009-09-03 21:17 UTC] pajoye@php.net
Please (all :) try a snapshot, php 5.3 or 6 (5.3 recommended anyway :).


 [2009-09-06 18:13 UTC] benadler at gmx dot net
I tried the newest snapshot and it seems to work - thank you!

But, could it be that the environment is not set up correctly?
Suddenly I start getting all those imagemagick-temp files in the
script's directory. I imagine the reason may be that the %TEMP% or
%TMP% system/user variables are not set correctly.
 [2009-09-07 11:11 UTC] benadler at gmx dot net
Ok, it works on the commandline but not using IIS6 and fastcgi with fastcgi.impersonate = 1;.

This is test.php:

<?php
$out = array();
echo exec("echo %USERNAME%", $out);
print_r($out);

$out = array();
echo exec("echo %USERPROFILE%", $out);
print_r($out);
?>

and this results in:

%USERNAME%Array
(
    [0] => %USERNAME%
)
C:\Documents and Settings\Default UserArray
(
    [0] => C:\Documents and Settings\Default User
)

So it seems the user's profile/environment is not correctly set up.

I think username should be either domain\deabjs1 or just deabjs1, because this is what I use to log on to IIS using NTLM. I'm still using the same snapshot I was using at [6 Sep 6:13pm UTC].

Thanks for your help!
ben
 [2009-09-07 11:17 UTC] benadler at gmx dot net
Hope I'm not too verbose. Maybe it helps to see that calling this

exec("d:/programme/imagemagick/convert.exe -density $density $baseDirectory/$bookId/document.pdf -quality 95 $baseDirectory/$bookId/$version/page_%04d.jpg", $output);
print_r($output);

in a script run by the webserver (as above) causes this:

Array
(
    [0] => Error: /invalidfileaccess in --showpage--
    [1] => Operand stack:
    [2] =>    --nostringval--   1   true
    [3] => Execution stack:
    [4] =>    %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1905   1   3   %oparray_pop   1904   1   3   %oparray_pop   1888   1   3   %oparray_pop   --nostringval--   --nostringval--   2   1   4   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--   1777   1   9   %oparray_pop   --nostringval--   --nostringval--
    [5] => Dictionary stack:
    [6] =>    --dict:1155/1684(ro)(G)--   --dict:1/20(G)--   --dict:75/200(L)--   --dict:75/200(L)--   --dict:106/127(ro)(G)--   --dict:275/300(ro)(G)--   --dict:22/25(L)--   --dict:4/6(L)--   --dict:22/40(L)--
    [7] => Current allocation mode is local
    [8] => Last OS error: Bad file descriptor
)
 [2009-09-07 11:34 UTC] pajoye@php.net
I'm not sure the users environment is set, that's a different thing.

But is it the correct user?
 [2009-09-07 22:42 UTC] benadler at gmx dot net
I checked using Process Monitor - convert.exe is NOT started by the correct user:

User: NT AUTHORITY\NETWORK SERVICE
Auth ID: 00000000:000003e4
 [2009-09-08 17:58 UTC] pajoye@php.net
Just a quick note about the user profile, it is not set (by design) so I won't try to access the profile data.

More on the impersonated problem later.
 [2009-09-16 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2009-09-22 20:04 UTC] pajoye@php.net
Stupid auto no feedback.
 [2009-09-22 20:11 UTC] pajoye@php.net
Please tell me how you setup FCGI, I did test it under FCGI with impersonate set and the cmd are actually called using the impersonated user.

Can you try again using a recent snapshot to be sure that we use the same bins?
 [2009-09-30 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2009-11-20 00:52 UTC] louis at steelbytes dot com
appears to be still broken in 5.3.1
 [2010-02-03 00:13 UTC] jfjauvin at gmail dot com
This bug seems to be still there, no update for a while.  From my Process Monitor logs, there is no apparent permission errors. It looks like cmd.exe is not event launched.

PHP 5.3.1
MSVC9
FastCGI
Microsoft-IIS/7.0


PHP Warning:  exec() [<a href='function.exec'>function.exec</a>]: Unable to fork ['cmd /c echo Hello World!] in D:\Inetpub\wwwroot\www.example.com\test.php on line 3


"Sequence","Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"n/a","12:04:43.1093656 PM","w3wp.exe","4064","CreateFile","D:\Inetpub\wwwroot\www.example.com\test.php\web.config","PATH NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com"
"n/a","12:04:43.1095972 PM","w3wp.exe","4064","CreateFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, No Buffering, Attributes: RE, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1097796 PM","w3wp.exe","4064","QueryAllInformationFile","D:\Inetpub\wwwroot\www.example.com\test.php","BUFFER OVERFLOW","CreationTime: 7/10/2009 11:29:33 AM, LastAccessTime: 7/10/2009 11:29:33 AM, LastWriteTime: 2/2/2010 12:04:35 PM, ChangeTime: 2/2/2010 12:04:35 PM, FileAttributes: A, AllocationSize: 4,096, EndOfFile: 43, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x100000000416b, EaSize: 0, Access: Generic Read, Position: 0, Mode: Sequential Access, No Buffering, AlignmentRequirement: Word"
"n/a","12:04:43.1102377 PM","php-cgi.exe","2760","CreateFile","D:\Inetpub\wwwroot\www.example.com","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1102797 PM","php-cgi.exe","2760","QueryDirectory","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Filter: test.php, 1: test.php"
"n/a","12:04:43.1103154 PM","php-cgi.exe","2760","CloseFile","D:\Inetpub\wwwroot\www.example.com","SUCCESS",""
"n/a","12:04:43.1104406 PM","php-cgi.exe","2760","CreateFile","D:\Inetpub\wwwroot","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1104738 PM","php-cgi.exe","2760","QueryDirectory","D:\Inetpub\wwwroot\www.example.com","SUCCESS","Filter: www.example.com, 1: www.example.com"
"n/a","12:04:43.1105034 PM","php-cgi.exe","2760","CloseFile","D:\Inetpub\wwwroot","SUCCESS",""
"n/a","12:04:43.1106205 PM","php-cgi.exe","2760","CreateFile","D:\Inetpub","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1106537 PM","php-cgi.exe","2760","QueryDirectory","D:\Inetpub\wwwroot","SUCCESS","Filter: wwwroot, 1: wwwroot"
"n/a","12:04:43.1106805 PM","php-cgi.exe","2760","CloseFile","D:\Inetpub","SUCCESS",""
"n/a","12:04:43.1107412 PM","php-cgi.exe","2760","CreateFile","D:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1107733 PM","php-cgi.exe","2760","QueryDirectory","D:\Inetpub","SUCCESS","Filter: Inetpub, 1: Inetpub"
"n/a","12:04:43.1108023 PM","php-cgi.exe","2760","CloseFile","D:\","SUCCESS",""
"n/a","12:04:43.1111529 PM","php-cgi.exe","2760","CreateFile","D:\Inetpub\wwwroot\www.example.com","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1112066 PM","php-cgi.exe","2760","QueryDirectory","D:\Inetpub\wwwroot\www.example.com\.user.ini","NO SUCH FILE","Filter: .user.ini"
"n/a","12:04:43.1112443 PM","php-cgi.exe","2760","CloseFile","D:\Inetpub\wwwroot\www.example.com","SUCCESS",""
"n/a","12:04:43.1117452 PM","php-cgi.exe","2760","CreateFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1118254 PM","php-cgi.exe","2760","ReadFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Offset: 0, Length: 43, Priority: Normal"
"n/a","12:04:43.1118720 PM","php-cgi.exe","2760","ReadFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Offset: 0, Length: 43, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"
"n/a","12:04:43.1122877 PM","php-cgi.exe","2760","QueryOpen","D:\Inetpub\wwwroot\www.example.com","SUCCESS","CreationTime: 7/10/2009 11:29:33 AM, LastAccessTime: 2/2/2010 9:52:00 AM, LastWriteTime: 2/2/2010 9:52:00 AM, ChangeTime: 2/2/2010 9:52:00 AM, AllocationSize: 4,096, EndOfFile: 4,096, FileAttributes: D"
"n/a","12:04:43.1123637 PM","php-cgi.exe","2760","QueryInformationVolume","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","VolumeCreationTime: 7/10/2009 12:05:39 PM, VolumeSerialNumber: 24A7-59D9, SupportsObjects: True, VolumeLabel: "
"n/a","12:04:43.1123930 PM","php-cgi.exe","2760","QueryAllInformationFile","D:\Inetpub\wwwroot\www.example.com\test.php","BUFFER OVERFLOW","CreationTime: 7/10/2009 11:29:33 AM, LastAccessTime: 7/10/2009 11:29:33 AM, LastWriteTime: 2/2/2010 12:04:35 PM, ChangeTime: 2/2/2010 12:04:35 PM, FileAttributes: A, AllocationSize: 4,096, EndOfFile: 43, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x100000000416b, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word"
"n/a","12:04:43.1124319 PM","php-cgi.exe","2760","ReadFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS","Offset: 0, Length: 43"
"n/a","12:04:43.1125218 PM","php-cgi.exe","2760","CloseFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS",""
"n/a","12:04:43.1128956 PM","php-cgi.exe","2760","QueryOpen","D:\Inetpub\wwwroot\www.example.com","SUCCESS","CreationTime: 7/10/2009 11:29:33 AM, LastAccessTime: 2/2/2010 9:52:00 AM, LastWriteTime: 2/2/2010 9:52:00 AM, ChangeTime: 2/2/2010 9:52:00 AM, AllocationSize: 4,096, EndOfFile: 4,096, FileAttributes: D"
"n/a","12:04:43.1131742 PM","php-cgi.exe","2760","QueryOpen","D:\PHP5\cmd.exe","NAME NOT FOUND",""
"n/a","12:04:43.1134247 PM","php-cgi.exe","2760","QueryOpen","D:\PHP5\cmd.exe","NAME NOT FOUND",""
"n/a","12:04:43.1137195 PM","php-cgi.exe","2760","QueryOpen","C:\Windows\System32\cmd.exe","FAST IO DISALLOWED",""
"n/a","12:04:43.1139779 PM","php-cgi.exe","2760","CreateFile","C:\Windows\System32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1140326 PM","php-cgi.exe","2760","QueryBasicInformationFile","C:\Windows\System32\cmd.exe","SUCCESS","CreationTime: 1/19/2008 12:34:23 AM, LastAccessTime: 1/19/2008 12:34:23 AM, LastWriteTime: 1/19/2008 2:33:04 AM, ChangeTime: 2/2/2010 11:43:33 AM, FileAttributes: A"
"n/a","12:04:43.1140530 PM","php-cgi.exe","2760","CloseFile","C:\Windows\System32\cmd.exe","SUCCESS",""
"n/a","12:04:43.1143525 PM","php-cgi.exe","2760","QueryOpen","C:\Windows\System32\cmd.exe","FAST IO DISALLOWED",""
"n/a","12:04:43.1146062 PM","php-cgi.exe","2760","CreateFile","C:\Windows\System32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1146850 PM","php-cgi.exe","2760","QueryBasicInformationFile","C:\Windows\System32\cmd.exe","SUCCESS","CreationTime: 1/19/2008 12:34:23 AM, LastAccessTime: 1/19/2008 12:34:23 AM, LastWriteTime: 1/19/2008 2:33:04 AM, ChangeTime: 2/2/2010 11:43:33 AM, FileAttributes: A"
"n/a","12:04:43.1147056 PM","php-cgi.exe","2760","CloseFile","C:\Windows\System32\cmd.exe","SUCCESS",""
"n/a","12:04:43.1150613 PM","php-cgi.exe","2760","CreateFile","C:\Windows\System32\cmd.exe","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1151266 PM","php-cgi.exe","2760","CreateFileMapping","C:\Windows\System32\cmd.exe","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"n/a","12:04:43.1151895 PM","php-cgi.exe","2760","CreateFileMapping","C:\Windows\System32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
"n/a","12:04:43.1152680 PM","php-cgi.exe","2760","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe","NAME NOT FOUND","Desired Access: Query Value, Enumerate Sub Keys"
"n/a","12:04:43.1153714 PM","php-cgi.exe","2760","CloseFile","C:\Windows\System32\cmd.exe","SUCCESS",""
"n/a","12:04:43.1155641 PM","php-cgi.exe","2760","CreateFile","D:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: DOMAIN\www.example.com, OpenResult: Opened"
"n/a","12:04:43.1156289 PM","php-cgi.exe","2760","QueryDirectory","D:\PHP5","SUCCESS","Filter: PHP5, 1: PHP5"
"n/a","12:04:43.1157083 PM","php-cgi.exe","2760","CloseFile","D:\","SUCCESS",""
"n/a","12:04:43.1158982 PM","php-cgi.exe","2760","QueryOpen","D:\PHP5","SUCCESS","CreationTime: 1/4/2010 12:15:47 PM, LastAccessTime: 2/2/2010 11:42:26 AM, LastWriteTime: 2/2/2010 11:42:26 AM, ChangeTime: 2/2/2010 11:42:26 AM, AllocationSize: 12,288, EndOfFile: 12,288, FileAttributes: D"
"n/a","12:04:43.1163648 PM","w3wp.exe","4064","CloseFile","D:\Inetpub\wwwroot\www.example.com\test.php","SUCCESS",""
 [2010-02-03 00:38 UTC] pajoye@php.net
It works just fine here, 5.3.1 or later with II6/7. The initial 

It looks to a configuration problem to me. PLs double check it and come back if you still experience this problem.
 [2010-02-10 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2010-03-24 21:43 UTC] heer2351 at zonnet dot nl
PHP 5.3.2 (cgi-fcgi) (built: Mar  3 2010 20:47:00)
FastCGI DLL Version 7.5.7693.0
Microsoft Windows Server 2003R2
IIS6

Exact same problem - PHP Warning: exec(): Unable to fork 
Changed PHP back to:
  PHP 5.2.13 (cgi-fcgi) (built: Feb 24 2010 14:37:42)

No fork problem, so it is not a configuration problem.
 [2010-03-24 22:08 UTC] pajoye@php.net
-Status: No Feedback +Status: Closed
 [2010-03-24 22:08 UTC] pajoye@php.net
It works just fine and you have the permission to the IIS user to execute the shell. See the other reports about that, I added the explanation and how to configure it correctly there.
 [2010-03-24 22:09 UTC] pajoye@php.net
you have >to give< the permission
 [2010-03-24 22:14 UTC] pajoye@php.net
Let me copy my note here as well:

Quick note here. It is necessary to give a given IUSR_* the permission
to use cmd.exe (%COMSPEC%). It is recommended not to do it as it may
introduce security issues, obviously. But if you really want to do it,
use:

cacls %COMSPEC% /E /G IUSR_xxxx:R
 [2010-03-24 22:45 UTC] heer2351 at zonnet dot nl
Thanks for your fast response.

I am running the website using an application pool and have configured a special user for that pool. I use the same user for anonymous access. So both the website as well as PHP use the same identity. This user has all the required rights. 

Just to test I have given this user rights to %COMSPEC% using cacls. Same error.
Gave IUSR_xxx rights, same error.
Gave IWAM_xxx rights, same error.

Please check what has changed between 5.2.13 and 5.3.2
 [2010-03-24 22:48 UTC] pajoye@php.net
Again, I did check in all possible configurations and it does work.

However please configure impersonation correctly for FastCGI (that's not the App pool settings).
 [2010-03-24 22:51 UTC] pajoye@php.net
See my comment and related link in #50542
 [2010-03-24 23:04 UTC] heer2351 at zonnet dot nl
FastCGI impersonation is configured correctly and ProcMon shows that cmd.exe is started with the correct user. The fork error however still shows.

I am now downloading the php-5.3.3-dev-nts-Win32-VC9-x86-dfsfix.zip file and will check if that solves the problem.
 [2010-03-24 23:07 UTC] pajoye@php.net
-Status: Closed +Status: Feedback
 [2010-03-24 23:07 UTC] pajoye@php.net
Then I need more details about your exact configuration (windows version, IIS version, fastcgi version, etc.)
 [2010-03-24 23:17 UTC] heer2351 at zonnet dot nl
5.3.3.dev did not solve the problem

Had most versions in my first post:
PHP 5.3.2 (cgi-fcgi) (built: Mar  3 2010 20:47:00)
FastCGI DLL Version 7.5.7693.0
Microsoft Windows Server 2003R2
IIS6 - dll's have version 6.0.3790.1830

Do you need anymore information?
 [2010-03-24 23:22 UTC] heer2351 at zonnet dot nl
Maybe superfluous, but the only change I make is in the fcgiext.ini

I change the ExePath from:
ExePath=D:\PHP\PHP_5_2_13\php-cgi.exe
No fork error

To
ExePath=D:\PHP\PHP_5_3_3_dev\php-cgi.exe
Fork error

Rights are assigned on D:\PHP and inherit down, so that can not be the problem. No other changes to my environment for the problem to appear.
 [2010-03-24 23:39 UTC] pajoye@php.net
Yes, which command do you call?
 [2010-03-24 23:40 UTC] pajoye@php.net
And how exactly did you configure FCGI (impersonation). As your configuration is exactly one of my tests configuration, and it works just fine.
 [2010-03-24 23:50 UTC] heer2351 at zonnet dot nl
I am using a simple test script to do the test:
<?php
echo exec('cmd /c echo Hello World!');
?> 

FastCGI impersonation:
In PHP.ini
fastcgi.impersonate = 1

IIS:
Anonymous Authentication = On 
User is same user as Application Pool user

User has been added to IIS_WPG
 [2010-03-24 23:53 UTC] pajoye@php.net
Can you try using: c:\Windows\System32\whoami please?
 [2010-03-24 23:56 UTC] heer2351 at zonnet dot nl
BTW if I run the same script on the webserver using fakeCGI and runas to run as the application pool user it works.

Fake FastCGI web server
FCGI_PARAMS sent
FCGI_STDIN sent
Launching receive loop
FCGI_STDOUT: X-Powered-By: PHP/5.3.2
Content-type: text/html; charset=utf-8

Hello World!"

FCGI_END_REQUEST received
killing app
FastCGI process exited with 0

So the problem is definitely in the combination IIS6 and PHP 5.3
 [2010-03-24 23:58 UTC] heer2351 at zonnet dot nl
Result:
PHP Warning: exec(): Unable to fork [c:\Windows\System32\whoami] in D:\Web\Public\Typo3\v4_2_6\fdha_hr\hr\forkTest.php on line 2
 [2010-03-25 00:00 UTC] pajoye@php.net
It is not the same context using runas or impersonate.

Did you use "c:\\....\\whoami" or "cmd /c..."?
 [2010-03-25 00:04 UTC] pajoye@php.net
btw, is it possible to access this box? I could try to debug what's wrong there as it works just fine with the same constellation here (same windows, IIS and fcgi versions).
 [2010-03-25 00:08 UTC] heer2351 at zonnet dot nl
This is what I ran:
<?php
echo exec('c:\Windows\System32\whoami');
?> 

ProcMon shows cmd.exe being started by php-cgi.exe
A thread is created running as the correct user.
Excecuted command is: cmd.exe /c "c:\Windows\System32\whoami"

I do notice that the process exits with Exit Status 5, which is normally access denied.

I have however already tried to give Everyone full access to the whole machine, i.e. all drives. Still the same error.
 [2010-03-25 00:09 UTC] heer2351 at zonnet dot nl
Box is behind a company firewall so you can unfortunately not access it.
This is an intranet site.
 [2010-03-25 00:11 UTC] pajoye@php.net
echo exec('c:\Windows\System32\whoami'); can't work.

echo exec('c:\\Windows\\System32\\whoami'); should work.
 [2010-03-25 00:13 UTC] heer2351 at zonnet dot nl
What I do not understand is that 5.2.13 works and 5.3.2 (or 5.3.3) does not work with the same configuration.
 [2010-03-25 00:17 UTC] heer2351 at zonnet dot nl
Changed to your suggestion with \\, same error.

Changed to 5.2.13 ran my version and your version both echo the correct username.
 [2010-03-25 00:30 UTC] pajoye@php.net
I don't know either and hard to say why it does not work for you but for us (same config).

I feel like you actually configure it wrong. impersonation in 5.2 was not fully working and was not doing the right thing (not only for exec&co).

I can't help further without more details about how you configure the impersonation or having a remote access to debug.
 [2010-03-25 00:40 UTC] heer2351 at zonnet dot nl
Thanks for your help. I think there are still more people with the same problem. I will try to find a solution and will post here if I find one.
For now I stick with 5.2.13

I am not convinced it is a config problem. Will dig into SVN and find what the difference is between the two versions.
 [2010-03-25 00:45 UTC] pajoye@php.net
I will repeat a last time :) It does work here using IIS6 and the exact same windows version of FastCGI. The other users with issues with that have solved the problem as well using latest 5.3 and the right configuration.

There are differences between 5.2 and 5.3, a lot. One of them is a working impersonation (which is not only about exec).
 [2010-03-25 13:08 UTC] heer2351 at zonnet dot nl
Located the problem and have been able to fix it.

I am using a special user for my Application Pool (say AppPoolUser), so PHP runs as this user. The new exec function uses CreateProcessAsUser() with impersonation. This means that the AppPoolUser must have the right to change the process level token.

You can assign this right to the user in the "Local Security Settings" -> User Rights Assignment.

I have granted my AppPoolUser the "Replace a process level token" setting -> fork error has gone.

Thought this might be useful information, so access is required to cmd.exe but in addition the "Replace a process level token" setting.
 [2010-03-25 14:33 UTC] pajoye@php.net
-Status: Feedback +Status: To be documented -Assigned To: pajoye +Assigned To:
 [2010-03-25 14:33 UTC] pajoye@php.net
Ah nice, so another useful entry to add to the documentation, thanks for investigating it and report it back! :)
 [2010-03-28 19:43 UTC] pajoye@php.net
-Assigned To: +Assigned To: pajoye
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Mon Apr 21 00:02:04 2014 UTC