Ignore:
Timestamp:
May 29, 2013, 1:13:40 AM (9 years ago)
Author:
tboning
Message:
Rebase Scripts httpd patches for httpd 2.4:
File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/fc19-dev/server/common/patches/httpd-suexec-scripts.patch

    r2186 r2422  
    1 # scripts.mit.edu httpd suexec patch
    2 # Copyright (C) 2006, 2007, 2008  Jeff Arnold <jbarnold@mit.edu>,
    3 #                                 Joe Presbrey <presbrey@mit.edu>,
    4 #                                 Anders Kaseorg <andersk@mit.edu>,
    5 #                                 Geoffrey Thomas <geofft@mit.edu>
    6 #
    7 # This program is free software; you can redistribute it and/or
    8 # modify it under the terms of the GNU General Public License
    9 # as published by the Free Software Foundation; either version 2
    10 # of the License, or (at your option) any later version.
    11 #
    12 # This program is distributed in the hope that it will be useful,
    13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
    14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    15 # GNU General Public License for more details.
    16 #
    17 # You should have received a copy of the GNU General Public License
    18 # along with this program; if not, write to the Free Software
    19 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
    20 #
    21 # See /COPYRIGHT in this repository for more information.
    22 #
    23 --- httpd-2.2.2/support/Makefile.in.old 2005-07-06 19:15:34.000000000 -0400
    24 +++ httpd-2.2.2/support/Makefile.in     2007-01-20 17:12:51.000000000 -0500
    25 @@ -60,7 +60,7 @@
    26 
    27  suexec_OBJECTS = suexec.lo
    28  suexec: $(suexec_OBJECTS)
    29 -       $(LINK) $(suexec_OBJECTS)
    30 +       $(LINK) -lselinux $(suexec_OBJECTS)
    31 
    32  htcacheclean_OBJECTS = htcacheclean.lo
    33  htcacheclean: $(htcacheclean_OBJECTS)
    34 --- httpd-2.2.2/configure.in.old        2007-07-17 10:48:25.000000000 -0400
    35 +++ httpd-2.2.2/configure.in    2008-08-29 08:15:41.000000000 -0400
    36 @@ -559,6 +559,10 @@
     1From 8445788d68230b2e18739166f4c3ae6434038421 Mon Sep 17 00:00:00 2001
     2From: Alexander Chernyakhovsky <achernya@mit.edu>
     3Date: Fri, 3 May 2013 21:38:58 -0400
     4Subject: [PATCH 1/4] Add scripts-specific support to suexec
     5
     6This patch make suexec aware of static-cat, Scripts' tool to serve
     7static content out of AFS.  Specifically, this introduces a whitelist
     8of extensions for which suexec is supposed to invoke static-cat as a
     9content-handler.
     10
     11Additionally, this patch also sets JAVA_TOOL_OPTIONS, to allow the JVM
     12to start up in Scripts' limited memory environment.
     13
     14Furthermore, this patch deals with some of suexec's paranoia being
     15incorrect in an AFS world, by ignoring some of the irrelevant stat
     16results.
     17
     18Finally, add support for invoking php-cgi for php files, in a safe
     19manner that will strip arguments passed by Apache to php-cgi.
     20---
     21 configure.in     |    4 ++
     22 support/suexec.c |  172 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
     23 2 files changed, 173 insertions(+), 3 deletions(-)
     24
     25diff --git a/configure.in b/configure.in
     26index d93f78c..14faccf 100644
     27--- a/configure.in
     28+++ b/configure.in
     29@@ -720,6 +720,10 @@ AC_ARG_WITH(suexec-userdir,
    3730 APACHE_HELP_STRING(--with-suexec-userdir,User subdirectory),[
    3831   AC_DEFINE_UNQUOTED(AP_USERDIR_SUFFIX, "$withval", [User subdirectory] ) ] )
     
    4538 APACHE_HELP_STRING(--with-suexec-docroot,SuExec root directory),[
    4639   AC_DEFINE_UNQUOTED(AP_DOC_ROOT, "$withval", [SuExec root directory] ) ] )
    47 --- httpd-2.2.11/support/suexec.c.old   2008-11-30 10:47:31.000000000 -0500
    48 +++ httpd-2.2.11/support/suexec.c       2009-06-08 09:02:17.000000000 -0400
     40diff --git a/support/suexec.c b/support/suexec.c
     41index 5b6b254..e377042 100644
     42--- a/support/suexec.c
     43+++ b/support/suexec.c
    4944@@ -30,6 +30,9 @@
    5045  *
     
    5752 #include "ap_config.h"
    5853 #include "suexec.h"
    59 @@ -46,6 +49,7 @@
    60  #include <stdio.h>
    61  #include <stdarg.h>
    62  #include <stdlib.h>
    63 +#include <selinux/selinux.h>
    64  
    65  #ifdef HAVE_PWD_H
    66  #include <pwd.h>
    67 @@ -95,6 +99,7 @@
     54@@ -92,6 +95,7 @@ static const char *const safe_env_lst[] =
    6855 {
    6956     /* variable name starts with */
     
    7360 
    7461     /* variable name is */
    75 @@ -245,9 +250,108 @@
     62@@ -264,9 +268,108 @@ static void clean_env(void)
    7663     environ = cleanenv;
    7764 }
     
    182169     gid_t gid;              /* target group placeholder  */
    183170     char *target_uname;     /* target user name          */
    184 @@ -268,6 +368,7 @@
     171@@ -286,6 +389,7 @@ int main(int argc, char *argv[])
    185172      * Start with a "clean" environment
    186173      */
     
    188175+    setenv("JAVA_TOOL_OPTIONS", "-Xmx128M", 1); /* scripts.mit.edu local hack */
    189176 
    190      prog = argv[0];
    191      /*
    192 @@ -350,6 +451,20 @@
     177     /*
     178      * Check existence/validity of the UID of the user
     179@@ -369,6 +473,20 @@ int main(int argc, char *argv[])
    193180 #endif /*_OSD_POSIX*/
    194181 
     
    211198      * or attempts to back up out of the current directory,
    212199      * to protect against attacks.  If any are
    213 @@ -371,6 +486,7 @@
     200@@ -390,6 +508,7 @@ int main(int argc, char *argv[])
    214201         userdir = 1;
    215202     }
     
    219206      * Error out if the target username is invalid.
    220207      */
    221 @@ -452,7 +568,7 @@
     208@@ -471,7 +590,7 @@ int main(int argc, char *argv[])
    222209      * Error out if attempt is made to execute as root or as
    223210      * a UID less than AP_UID_MIN.  Tsk tsk.
     
    225212-    if ((uid == 0) || (uid < AP_UID_MIN)) {
    226213+    if ((uid == 0) || (uid < AP_UID_MIN && uid != 102)) { /* uid 102 = signup  */
    227          log_err("cannot run as forbidden uid (%d/%s)\n", uid, cmd);
     214         log_err("cannot run as forbidden uid (%lu/%s)\n", (unsigned long)uid, cmd);
    228215         exit(107);
    229216     }
    230 @@ -484,6 +599,7 @@
    231          log_err("failed to setuid (%ld: %s)\n", uid, cmd);
     217@@ -503,6 +622,7 @@ int main(int argc, char *argv[])
     218         log_err("failed to setuid (%lu: %s)\n", (unsigned long)uid, cmd);
    232219         exit(110);
    233220     }
     
    236223     /*
    237224      * Get the current working directory, as well as the proper
    238 @@ -506,6 +637,21 @@
     225@@ -525,6 +645,21 @@ int main(int argc, char *argv[])
    239226             log_err("cannot get docroot information (%s)\n", target_homedir);
    240227             exit(112);
     
    258245     else {
    259246         if (((chdir(AP_DOC_ROOT)) != 0) ||
    260 @@ -532,15 +678,17 @@
     247@@ -551,15 +686,17 @@ int main(int argc, char *argv[])
    261248     /*
    262249      * Error out if cwd is writable by others.
     
    277264         exit(117);
    278265     }
    279 @@ -548,10 +696,12 @@
     266@@ -567,10 +704,12 @@ int main(int argc, char *argv[])
    280267     /*
    281268      * Error out if the program is writable by others.
     
    290277     /*
    291278      * Error out if the file is setuid or setgid.
    292 @@ -565,6 +715,7 @@
     279@@ -584,6 +723,7 @@ int main(int argc, char *argv[])
    293280      * Error out if the target name/group is different from
    294281      * the name/group of the cwd or the program.
     
    298285         (gid != dir_info.st_gid) ||
    299286         (uid != prg_info.st_uid) ||
    300 @@ -576,12 +727,14 @@
    301                  prg_info.st_uid, prg_info.st_gid);
     287@@ -595,12 +735,14 @@ int main(int argc, char *argv[])
     288                 (unsigned long)prg_info.st_uid, (unsigned long)prg_info.st_gid);
    302289         exit(120);
    303290     }
     
    314301         exit(121);
    315302     }
    316 @@ -614,6 +767,30 @@
     303@@ -649,6 +791,30 @@ int main(int argc, char *argv[])
    317304     /*
    318305      * Execute the command, replacing our image with its own.
     
    345332     /* We need the #! emulation when we want to execute scripts */
    346333     {
     334--
     3351.7.9.6 (Apple Git-31.1)
     336
Note: See TracChangeset for help on using the changeset viewer.