php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29207 Wrong script uid with safe_mode
Submitted: 2004-07-16 12:53 UTC Modified: 2005-02-11 01:00 UTC
Votes:6
Avg. Score:4.3 ± 0.5
Reproduced:6 of 6 (100.0%)
Same Version:2 (33.3%)
Same OS:2 (33.3%)
From: ksvee at usit dot uio dot no Assigned:
Status: No Feedback Package: Filesystem function related
PHP Version: 4.3.10 OS: Solaris 8
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ksvee at usit dot uio dot no
New email:
PHP Version: OS:

 

 [2004-07-16 12:53 UTC] ksvee at usit dot uio dot no
Description:
------------
This is really an old bug that seems to be coming and going, but I cannot find an open bug on it. 

References: bugs #18500, #12683 and #7744

The latest version that this bug is not alive and well is 4.2.3 which is the one we still use. I've tested (just about) every (release) version since, and reproduced the bug in all of them. That includes the latest (4.3.8) tested today, 2004-07-16. I use PHP with Apache 1.3.x (1.3.31 latest).


Description:

When using SAFE_MODE = ON, php reports uid=1 on the running php-script as well as its proper uid:

-----
[datetag] [error] PHP Warning:  Unknown(): SAFE MODE Restriction in effect.  The script whose uid is 1 is not
 allowed to access /path/to/script.php owned by uid 26658 in Unknown on line 0
-----

If I chown the script to another user, e.g. root, the report looks like this:

-----
[datetag] [error] PHP Warning:  Unknown(): SAFE MODE Restriction in effect.  The script whose uid is 1 is not allowed to access /path/to/script.php owned by uid 0 in Unknown on line 0
-----

If i chown it to uid=1 ('daemon' on my systems) then it seems to work, except that the file I intend to include also needs to be owned by daemon. This included file at least seems to have its owner reported correctly, the full report being:

-----
[datetag] [error] PHP Warning:  main(): SAFE MODE Restriction in effect.  The script whose uid is 1 is not allowed to access ./filename.inc owned by uid 26658 in /a/b/c/include.php on line 2
[datetag] [error] PHP Warning:  main(filename.inc): failed to open stream: Error 0 in /a/b/c/include.php on line 2
[datetag] [error] PHP Warning:  main(): Failed opening 'filename.inc' for inclusion (include_path='.') in /a/b/c/include.php on line 2
-----

We usually use a non-standard config, compiling Apache, PHP, OpenSSL etc under a specific prefix, but dumbing this to default paths has no impact. 

Using "--with-apxs=/path/to/apxs --prefix=/path/to/installprefix" as the only config parameters to PHP too has no impact on the results.

As for php.ini, I've tried using a clean copy of both "php.ini-recommended" and "php.ini-dist" with no other modifications than setting "safe_mode = On". No significant changes.


Rgds,
Kenneth Svee


Reproduce code:
---------------
# Content of include.php:
<?php
include("filename.inc");
?>

# (filename.inc is in same dir as include.php, and
# contains just an arbitrary string, e.g.:
"I've been included!"

Expected result:
----------------
# I expected the string in filename.inc:
"I've been included!"

Actual result:
--------------
Just the empty page, and the errormessages in Apaches error_log.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-12-21 11:58 UTC] ksvee at usit dot uio dot no
Verified bug with Apache 1.3.33 and latest release (4.3.10) and latest stable cvs snapshot (php4-STABLE-200412210930).
 [2004-12-22 12:23 UTC] ksvee at usit dot uio dot no
Try including "-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" in CFLAGS given to configure[1]. It seems it triggers something that prevents the bug from appering. Haven't really managed to trace the bug yet, but it might have something to do with the stat/VCWD_STAT in main/safe_mode.c that sets "uid = sb.st_uid", sb being the stat-struct.

I'm now testing 4.3.11-dev (or rather stable cvs release php4-STABLE-200412220730, as bug #31121 prevents proper compile of 4.3.10 using sun cc[2]) with a generic Apache 1.3.33, and it seems to be working properly with safe_mode.


[1]: CFLAGS='-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64' \
CC='cc' CCC='CC' ./configure \
--with-apxs=/path/to/apxs \
--prefix=/my/prefix

[2]: cc: Sun WorkShop 6 update 2 C 5.3 2001/05/15
 [2005-02-11 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Sat Nov 16 23:01:41 2019 UTC