php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #53591 exec() fails to impersonate calling context when fastcgi.impersonate is true
Submitted: 2010-12-22 00:10 UTC Modified: 2010-12-31 00:45 UTC
From: sbacsa at gmail dot com Assigned:
Status: Not a bug Package: IIS related
PHP Version: 5.3.4 OS: Windows Server 2008
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: sbacsa at gmail dot com
New email:
PHP Version: OS:

 

 [2010-12-22 00:10 UTC] sbacsa at gmail dot com
Description:
------------
It appears that enabling fastcgi.impersonate on Windows in PHP 5.3.x does not 
actually impersonate the calling user when using exec() or similar.

I would just get messages saying "Cannot fork", whereas in PHP 5.2.x there was no 
such error.

Turning off fastcgi.impersonate fixed this issue, as IIS seems to run PHP in the 
user context of the worker process anyway.

Test script:
---------------
<?

// This will fail when fastcgi.impersonate = 1 in PHP 5.3.x
exec("c:\\path\\to\\executable.exe");

Expected result:
----------------
The file should be successfully executed if the worker process user has permission 
to access the EXE.

Actual result:
--------------
Regardless of worker process permissions, an error message saying:

"Warning: exec() [function.exec]: Unable to fork [c:\path\to\executable.exe]"

is encountered.



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-12-22 01:02 UTC] pajoye@php.net
-Status: Open +Status: Bogus
 [2010-12-22 01:02 UTC] pajoye@php.net
You have to give FCGI's php handler the permission to execute codes. Check out the IIS documentation (as far as I remember it is also documented in the PHP manual, in the IIS configuration part).
 [2010-12-31 00:45 UTC] sbacsa at gmail dot com
I have done all of that, and that was not a solution.

If you disable fastcgi.impersonate, then it will run in the user context of the 
worker process (whatever you set it to; I set it to a custom user account), so 
clearly it DOES impersonate the user, but it just does not seem to work with 
whatever fastcgi.impersonate tries to do.

That being said, this was not an issue in PHP 5.2.x; it worked with 
fastcgi.impersonate and did not cause errors.  All I did was replace the PHP 
binaries with the new version and configured IIS.  There should be no reason why 
it should fail.
 
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Jan 31 20:05:54 2023 UTC