Received: (qmail 23306 invoked by uid 501); 17 Dec 2001 11:57:53 -0000 Message-Id: <20011217115753.23305.qmail@apache.org> Date: 17 Dec 2001 11:57:53 -0000 From: Rainer Doerntge Reply-To: doerntge@kiwilogic.com To: submit@bugz.apache.org Subject: FollowSymLinks does not work on ext3 Filesystem X-Send-Pr-Version: 3.110 >Number: 9153 >Category: general >Synopsis: FollowSymLinks does not work on ext3 Filesystem >Confidential: no >Severity: non-critical >Priority: medium >Responsible: apache >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Mon Dec 17 04:00:00 PST 2001 >Closed-Date: Mon Dec 17 07:18:52 PST 2001 >Last-Modified: Mon Dec 17 07:30:01 PST 2001 >Originator: doerntge@kiwilogic.com >Release: 1.3.20 >Organization: >Environment: Linux SuSE kernel: Linux klinux 2.4.10-64GB-SMP #1 SMP Tue Sep 25 12:36:09 GMT 2001 i686 unknown gcc v2.95.3 System ist IBM SMP wit 2 Pentium III Coppermines running at 833Mhz each. >Description: On our new server, I installed the home directories on a hd partition running an ext3 Filesystem. If a user calls up any file in ~.../, it works. If that file is a symbolic link, an internal server error is generated, even with FollowSymLinks or SymLinksIfOwnerMatch enabled. So, I created a test user with a home directory on another partition (this one running reiserfs), and - it works. >How-To-Repeat: Make an ext3-Partition. Create a user on that partition or an alias like Alias /some-alias/ "/path/to/dir/on/ext3/partition" Options FollowSymLinks AllowOverride None Order allow,deny Allow from all Then put some example html into that directory and create a symbolic link pointing to that html. Call the regular html file and then try to call the linked one. >Fix: No. >Release-Note: >Audit-Trail: From: =?iso-8859-1?Q?Rainer_D=F6rntge?= To: Cc: Subject: Re: general/9153: FollowSymLinks does not work on ext3 Filesystem Date: Mon, 17 Dec 2001 15:17:05 +0100 > -----Urspr=FCngliche Nachricht----- > Von: submit@bugz.apache.org [mailto:submit@bugz.apache.org] > Gesendet: Montag, 17. Dezember 2001 13:00 > An: Rainer D=F6rntge > Betreff: Re: general/9153: FollowSymLinks does not work on ext3 > Filesystem >=20 >=20 > Thank you very much for your problem report. > It has the internal identification `general/9153'. > The individual assigned to look at your > report is: apache.=20 >=20 > >Category: general > >Responsible: apache > >Synopsis: FollowSymLinks does not work on ext3 Filesystem > >Arrival-Date: Mon Dec 17 04:00:00 PST 2001 >=20 Hi, we have located the problem which is NOT an ext3-problem. It comes with mod_suexec. if the lstat() call to the program is replaced by stat(), it works. <------------------- diff -u output BEGIN -------------------> --- suexec.c.orig Mon Dec 17 15:12:42 2001 +++ suexec.c Mon Dec 17 15:07:56 2001 @@ -534,7 +534,7 @@ /* * Error out if we cannot stat the program. */ - if (((lstat(cmd, &prg_info)) !=3D 0) || = (S_ISLNK(prg_info.st_mode))) { + if (((stat(cmd, &prg_info)) !=3D 0) || (S_ISLNK(prg_info.st_mode))) = { log_err("error: cannot stat program: (%s)\n", cmd); exit(117); } <------------------- diff -u output END -------------------> Is it a bug or a feature? Should apache not follow symlinks to programs? Probably, some more code has to be applied to check whether FollowSymLinks or SymLinksIfOwnerMatch was set. Rainer To err is human - to purr feline. - Richard Byrne=20 kiwilogic.com ag | Rainer D=F6rntge | Am Sandtorkai 77=20 20457 Hamburg | Fon: +49 - 40 - 82 22 13 - 403=20 Germany | Fax: +49 - 40 - 82 22 13 - 100=20 http://www.kiwilogic.com | mailto:doerntge@kiwilogic.com=20 Map = http://www.stadtplandienst.de/query;ORT=3Dhh;LL=3D9.984x53.5442;GR=3D5 WebCam http://www.hafen-hamburg.de/webcam/center_webcam.php?wrap=3D1&navoben= =3D 1 State-Changed-From-To: open-closed State-Changed-By: slive State-Changed-When: Mon Dec 17 07:18:52 PST 2001 State-Changed-Why: suexec does not follow symlinks as part of its basic security model. For security reasons, it needs to tightly restrict the areas from which scripts can be run. Thanks for using Apache. Release-Changed-From-To: any 1.3 >= 1.3.20-1.3.20 Release-Changed-By: slive Release-Changed-When: Mon Dec 17 07:18:52 PST 2001 From: =?iso-8859-1?Q?Rainer_D=F6rntge?= To: Cc: Subject: Re: general/9153: FollowSymLinks does not work on ext3 Filesystem Date: Mon, 17 Dec 2001 16:20:40 +0100 > -----Urspr=FCngliche Nachricht----- > Von: submit@bugz.apache.org [mailto:submit@bugz.apache.org] > Gesendet: Montag, 17. Dezember 2001 13:00 > An: Rainer D=F6rntge > Betreff: Re: general/9153: FollowSymLinks does not work on ext3 > Filesystem >=20 >=20 > Thank you very much for your problem report. > It has the internal identification `general/9153'. > The individual assigned to look at your > report is: apache.=20 >=20 > >Category: general > >Responsible: apache > >Synopsis: FollowSymLinks does not work on ext3 Filesystem > >Arrival-Date: Mon Dec 17 04:00:00 PST 2001 >=20 Hi, we have located the problem which is NOT an ext3-problem. It comes with mod_suexec. if the lstat() call to the program is replaced by stat(), it works. <------------------- diff -u output BEGIN -------------------> --- suexec.c.orig Mon Dec 17 15:12:42 2001 +++ suexec.c Mon Dec 17 15:07:56 2001 @@ -534,7 +534,7 @@ /* * Error out if we cannot stat the program. */ - if (((lstat(cmd, &prg_info)) !=3D 0) || = (S_ISLNK(prg_info.st_mode))) { + if (((stat(cmd, &prg_info)) !=3D 0) || (S_ISLNK(prg_info.st_mode))) = { log_err("error: cannot stat program: (%s)\n", cmd); exit(117); } <------------------- diff -u output END -------------------> Is it a bug or a feature? Should apache not follow symlinks to programs? Probably, some more code has to be applied to check whether FollowSymLinks or SymLinksIfOwnerMatch was set. Rainer To err is human - to purr feline. - Richard Byrne=20 kiwilogic.com ag | Rainer D=F6rntge | Am Sandtorkai 77=20 20457 Hamburg | Fon: +49 - 40 - 82 22 13 - 403=20 Germany | Fax: +49 - 40 - 82 22 13 - 100=20 http://www.kiwilogic.com | mailto:doerntge@kiwilogic.com=20 Map = http://www.stadtplandienst.de/query;ORT=3Dhh;LL=3D9.984x53.5442;GR=3D5 WebCam http://www.hafen-hamburg.de/webcam/center_webcam.php?wrap=3D1&navoben= =3D 1 From: =?iso-8859-1?Q?Rainer_D=F6rntge?= To: Cc: Subject: Re: general/9153: FollowSymLinks does not work on ext3 Filesystem Date: Mon, 17 Dec 2001 16:20:40 +0100 > -----Urspr=FCngliche Nachricht----- > Von: submit@bugz.apache.org [mailto:submit@bugz.apache.org] > Gesendet: Montag, 17. Dezember 2001 13:00 > An: Rainer D=F6rntge > Betreff: Re: general/9153: FollowSymLinks does not work on ext3 > Filesystem >=20 >=20 > Thank you very much for your problem report. > It has the internal identification `general/9153'. > The individual assigned to look at your > report is: apache.=20 >=20 > >Category: general > >Responsible: apache > >Synopsis: FollowSymLinks does not work on ext3 Filesystem > >Arrival-Date: Mon Dec 17 04:00:00 PST 2001 >=20 Hi, we have located the problem which is NOT an ext3-problem. It comes with mod_suexec. if the lstat() call to the program is replaced by stat(), it works. <------------------- diff -u output BEGIN -------------------> --- suexec.c.orig Mon Dec 17 15:12:42 2001 +++ suexec.c Mon Dec 17 15:07:56 2001 @@ -534,7 +534,7 @@ /* * Error out if we cannot stat the program. */ - if (((lstat(cmd, &prg_info)) !=3D 0) || = (S_ISLNK(prg_info.st_mode))) { + if (((stat(cmd, &prg_info)) !=3D 0) || (S_ISLNK(prg_info.st_mode))) = { log_err("error: cannot stat program: (%s)\n", cmd); exit(117); } <------------------- diff -u output END -------------------> Is it a bug or a feature? Should apache not follow symlinks to programs? Probably, some more code has to be applied to check whether FollowSymLinks or SymLinksIfOwnerMatch was set. Rainer To err is human - to purr feline. - Richard Byrne=20 kiwilogic.com ag | Rainer D=F6rntge | Am Sandtorkai 77=20 20457 Hamburg | Fon: +49 - 40 - 82 22 13 - 403=20 Germany | Fax: +49 - 40 - 82 22 13 - 100=20 http://www.kiwilogic.com | mailto:doerntge@kiwilogic.com=20 Map = http://www.stadtplandienst.de/query;ORT=3Dhh;LL=3D9.984x53.5442;GR=3D5 WebCam http://www.hafen-hamburg.de/webcam/center_webcam.php?wrap=3D1&navoben= =3D 1 >Unformatted: [In order for any reply to be added to the PR database, you need] [to include in the Cc line and make sure the] [subject line starts with the report component and number, with ] [or without any 'Re:' prefixes (such as "general/1098:" or ] ["Re: general/1098:"). If the subject doesn't match this ] [pattern, your message will be misfiled and ignored. The ] ["apbugs" address is not added to the Cc line of messages from ] [the database automatically because of the potential for mail ] [loops. If you do not include this Cc, your reply may be ig- ] [nored unless you are responding to an explicit request from a ] [developer. Reply only with text; DO NOT SEND ATTACHMENTS! ]