rpms/httpd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix #716621 - suexec now works without setuid bit

Browse Source
This commit is contained in:
Jan Kaluza 2011-07-20 08:53:17 +02:00
parent 39b84c6853
commit a1caf8d2f6
2 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
httpd-2.2.9-suenable.patch
View File

@ -1,13 +1,20 @@
Removes setuid check because we are now using capabilities to ensure proper
suexec rights.
Upstream-Status: in trunk, differently Upstream-status: Not acceptable for upstream in current status.
suexec_enabled part is in trunk,differently
--- httpd-2.2.9/os/unix/unixd.c.suenable diff --git a/os/unix/unixd.c b/os/unix/unixd.c
+++ httpd-2.2.9/os/unix/unixd.c index 85d5a98..1ee1dfe 100644
@@ -215,7 +215,7 @@ AP_DECLARE(void) unixd_pre_config(apr_po --- a/os/unix/unixd.c
+++ b/os/unix/unixd.c
@@ -271,8 +271,8 @@ AP_DECLARE(void) unixd_pre_config(apr_pool_t *ptemp)
return;
} }
if ((wrapper.protection & APR_USETID) && wrapper.user == 0) { - if ((wrapper.protection & APR_USETID) && wrapper.user == 0) {
- unixd_config.suexec_enabled = 1; - unixd_config.suexec_enabled = 1;
+ if (wrapper.user == 0) {
+ unixd_config.suexec_enabled = access(SUEXEC_BIN, R_OK|X_OK) == 0; + unixd_config.suexec_enabled = access(SUEXEC_BIN, R_OK|X_OK) == 0;
} }
} }

8
httpd.spec
View File

@ -8,7 +8,7 @@
Summary: Apache HTTP Server Summary: Apache HTTP Server
Name: httpd Name: httpd
Version: 2.2.19 Version: 2.2.19
Release: 2%{?dist} Release: 3%{?dist}
URL: http://httpd.apache.org/ URL: http://httpd.apache.org/
Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.gz Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.gz
Source1: index.html Source1: index.html
@ -452,7 +452,8 @@ rm -rf $RPM_BUILD_ROOT
%{_sbindir}/ht* %{_sbindir}/ht*
%{_sbindir}/apachectl %{_sbindir}/apachectl
%{_sbindir}/rotatelogs %{_sbindir}/rotatelogs
%caps(cap_setuid,cap_setgid+pe) %attr(510,root,%{suexec_caller}) %{_sbindir}/suexec # cap_dac_override needed to write to /var/log/httpd
%caps(cap_setuid,cap_setgid,cap_dac_override+pe) %attr(510,root,%{suexec_caller}) %{_sbindir}/suexec
%dir %{_libdir}/httpd %dir %{_libdir}/httpd
%dir %{_libdir}/httpd/modules %dir %{_libdir}/httpd/modules
@ -511,6 +512,9 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/httpd/build/*.sh %{_libdir}/httpd/build/*.sh
%changelog %changelog
* Wed Jul 20 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-3
- fix #716621 - suexec now works without setuid bit
* Thu Jul 14 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-2 * Thu Jul 14 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-2
- fix #689091 - backported patch from 2.3 branch to support IPv6 in logresolve - fix #689091 - backported patch from 2.3 branch to support IPv6 in logresolve