Received: (qmail 8641 invoked by uid 2012); 18 Jun 1999 13:33:56 -0000
Message-Id: <19990618133356.8640.qmail@hyperreal.org>
Date: 18 Jun 1999 13:33:56 -0000
From: Olivier Nicole <on@cs.ait.ac.th>
Reply-To: on@cs.ait.ac.th
To: apbugs@hyperreal.org
Subject: <!--#set does not work with suexec
X-Send-Pr-Version: 3.2

>Number:         4605
>Category:       suexec
>Synopsis:       <!--#set does not work with suexec
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   apache
>Arrival-Date:   Fri Jun 18 06:40:00 PDT 1999
>Closed-Date:    Fri Jan 07 14:38:00 PST 2000
>Last-Modified:  Fri Jan 07 14:38:00 PST 2000
>Originator:     on@cs.ait.ac.th
>Release:        Apache/1.3.1 Ben-SSL/1.24 (Unix)
>Organization:
>Environment:
ufo.cs.ait.ac.th<on>47: uname -a
FreeBSD ufo.cs.ait.ac.th 2.2.7-RELEASE FreeBSD 2.2.7-RELEASE #0: Thu Feb 18 14:5
5:44 ICT 1999     root@ufo.cs.ait.ac.th:/usr/src/sys/compile/SMALL  i386
ufo.cs.ait.ac.th<on>48: gcc -v
gcc version 2.7.2.1
ufo.cs.ait.ac.th<on>49:
>Description:
Hello

When configuring virtual host to run under a different user than the default apache
user (here is the virtual hgost config)
<VirtualHost www.cs.ait.ac.th:80>
SSLDisable
DocumentRoot    /home/www.cs.ait.ac.th/htdocs
ServerName      www.cs.ait.ac.th
# I cannot use csim here, I dunno why, if use csim, I cannot use
# <!--#set SSI directive
User            httpd
ServerAdmin     on@cs.ait.ac.th
TransferLog     /home/www.cs.ait.ac.th/logs/transfer_log
ErrorLog        /home/www.cs.ait.ac.th/logs/error_log
ScriptAlias     /cgi-bin        /home/www.cs.ait.ac.th/cgi-bin
Redirect        /~wutt          http://www.cs.ait.ac.th/wutt
Redirect        /smartnet99             http://www.cs.ait.ac.th/~ca/smartnet99
ScriptAlias     /Harvest/cgi-bin/       /home/www.cs.ait.ac.th/htdocs/Harvest/cg
i-bin/
Alias           /Harvest/       /home/www.cs.ait.ac.th/htdocs/Harvest/
<Directory /home/www.cs.ait.ac.th/htdocs/CSIM-limited>
AddHandler CSIM-limited html
AddHandler CSIM-limited shtml
Action CSIM-limited /cgi-bin/CSIM-limited
</Directory>
</VirtualHost>                                                  

User httpd is the default apache user, I want to use a specific user for that virtual\
host, with the directive User csim

When I do that, every thing goes fine except that the <!--#set XSSI directives
are not passed to the <!--#exec'ed CGI (i.e. I don't get new environment variables set
with what information I would like to set).

I presume this is a restriction due to suexec that limit the environment
variables passed to the process after it has done a setuid.

I do need suexec, I do need to run the different virtual hosts under different 
users names and I would really like to use <!--#set directive

Thank you
>How-To-Repeat:
On a server with suexec and virtual hosts, set a virtual host to run under a
user different from the default apache user

User a web page like

<!--#set var="foo" value="bar" -->
<!--#exec cgi="/cgi-bin/test" -->

test CGI doing nothing more than printing the list of environment variables, I
could not see the variable foo with the value bar
>Fix:
If only...
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open-closed
State-Changed-By: coar
State-Changed-When: Fri Jan  7 14:38:00 PST 2000
State-Changed-Why:

You are correct, suexec has a severely limited number of
environment variables that it will pass on to the
exec'd script.  Arbitrary envariables set by SSI directives
are not among them.  However, you *can* use different
User/Group values on a per-vhost basis; that's supported.
Please upgrade to 1.3.9 and try that aspect again.  If
you want the arbitrary envariables, you're going to need
to alter the suexec source yourself.  Thanks for using
Apache!

Class-Changed-From-To: sw-bug-change-request
Class-Changed-By: coar
Class-Changed-When: Fri Jan  7 14:38:00 PST 2000
>Unformatted:
[In order for any reply to be added to the PR database, you need]
[to include <apbugs@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or      ]
["Re: general/1098:").  If the subject doesn't match this       ]
[pattern, your message will be misfiled and ignored.  The       ]
["apbugs" address is not added to the Cc line of messages from  ]
[the database automatically because of the potential for mail   ]
[loops.  If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request from a  ]
[developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]