perlbug-followup at perl
May 24, 2012, 7:59 PM
Post #1 of 1
(38 views)
Permalink
|
|
[perl #41344] setuid perl: "Setuid script changed" error when root cannot access directory
|
|
On Thu Jan 25 09:15:39 2007, varhus [at] seas wrote:
>
> This is a bug report for perl from varhus [at] seas,
> generated with the help of perlbug 1.35 running under perl v5.8.8.
>
>
> -----------------------------------------------------------------
> [Please enter your report here]
>
> If root cannot access the directory containing a setuid Perl script,
> running the setuid script fails with the misleading error "Setuid
> script changed". This can happen when, for example, the setuid script
> is on an NFS filesystem mounted from a server which exported it with
> what Linux calls the "root_squash" option.
>
> Both the original and target user can access the script, but suidperl
> tries to run several checks as root before doing seteuid() to the
> target user. The one that fails is this block:
>
> Stat_t tmpstatbuf;
> if (PerlLIO_stat(CopFILE(PL_curcop),&tmpstatbuf) < 0 ||
> tmpstatbuf.st_dev != PL_statbuf.st_dev ||
> tmpstatbuf.st_ino != PL_statbuf.st_ino) {
> Perl_croak(aTHX_ "Setuid script changed\n");
> }
>
> Since root doesn't have permission to search the directory containing
> the script, the stat() fails with an EACCES error. It seems to me
> that it would be safe to move this check to after the point at which
> suidperl does seteuid() later on, rather than doing it as root.
>
> Alternatively, it would be useful to not give this misleading error
> message. I realize that the comment right above the check says that
> this is where we must "lie" about return status. However, giving
> a better error message if stat() returns an EACCES error wouldn't
> seem to be giving extra information away, and would have saved me
> a lot of time trying to understand why Perl thought the script was
> changing when it clearly wasn't. Plus, this error message isn't
> documented in perldiag.
>
> [Please do not change anything below this line]
> -----------------------------------------------------------------
> ---
> Flags:
> category=core
> severity=low
> ---
> This perlbug was built using Perl v5.8.8 - Sun Apr 23 00:25:53 UTC
> 2006
> It is being executed now by Perl v5.8.8 - Sun Apr 23 00:20:53 UTC
> 2006.
>
> Site configuration information for perl v5.8.8:
>
> Configured by abuild at Sun Apr 23 00:20:53 UTC 2006.
>
> Summary of my perl5 (revision 5 version 8 subversion 8) configuration:
> Platform:
> osname=linux, osvers=2.6.16, archname=i586-linux-thread-multi
> uname='linux tait 2.6.16 #1 smp tue mar 14 18:04:33 utc 2006 i686
> i686 i386 gnulinux '
> config_args='-ds -e -Dprefix=/usr -Dvendorprefix=/usr
> -Dinstallusrbinperl -Dusethreads -Di_db -Di_dbm -Di_ndbm -Di_gdbm
> -Duseshrplib=true -Doptimize=-O2 -march=i586 -mtune=i686
> -fmessage-length=0 -Wall -D_FORTIFY_SOURCE=2 -g -Wall -pipe'
> hint=recommended, useposix=true, d_sigaction=define
> usethreads=define use5005threads=undef useithreads=define
> usemultiplicity=define
> useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
> use64bitint=undef use64bitall=undef uselongdouble=undef
> usemymalloc=n, bincompat5005=undef
> Compiler:
> cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS
> -DDEBUGGING -fno-strict-aliasing -pipe
> -Wdeclaration-after-statement -D_LARGEFILE_SOURCE
> -D_FILE_OFFSET_BITS=64',
> optimize='-O2 -march=i586 -mtune=i686 -fmessage-length=0 -Wall
> -D_FORTIFY_SOURCE=2 -g -Wall -pipe',
> cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS
> -DDEBUGGING -fno-strict-aliasing -pipe
> -Wdeclaration-after-statement'
> ccversion='', gccversion='4.1.0 (SUSE Linux)', gccosandvers=''
> intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
> d_longlong=define, longlongsize=8, d_longdbl=define,
> longdblsize=12
> ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
> lseeksize=8
> alignbytes=4, prototype=define
> Linker and Libraries:
> ld='cc', ldflags =''
> libpth=/lib /usr/lib /usr/local/lib
> libs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
> perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
> libc=/lib/libc-2.4.so, so=so, useshrplib=true, libperl=libperl.so
> gnulibc_version='2.4'
> Dynamic Linking:
> dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E
> -Wl,-rpath,/usr/lib/perl5/5.8.8/i586-linux-thread-multi/CORE'
> cccdlflags='-fPIC', lddlflags='-shared'
>
> Locally applied patches:
>
>
> ---
> @INC for perl v5.8.8:
> /usr/lib/perl5/5.8.8/i586-linux-thread-multi
> /usr/lib/perl5/5.8.8
> /usr/lib/perl5/site_perl/5.8.8/i586-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.8
> /usr/lib/perl5/site_perl
> /usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.8
> /usr/lib/perl5/vendor_perl
> .
>
> ---
> Environment for perl v5.8.8:
> HOME=/home1/v/varhus
> LANG=en_US
> LANGUAGE (unset)
> LD_LIBRARY_PATH (unset)
> LOGDIR (unset)
>
PATH=/home1/v/varhus/bin:/pkg/openssh/bin:/pkg/k/krb5/bin:/usr/local/bin:/usr/bin:/usr/X11R6/bin:/bin:/usr/games:/opt/gnome/bin:/opt/kde3/bin:/usr/lib/mit/bin:/usr/lib/mit/sbin:/usr/lib/qt3/bin:/sbin:/usr/sbin:/usr/local/sbin
> PERL_BADLANG (unset)
> SHELL=/pkg/bin/bash
This is gone from all recent Perls, so I'm marking this as resolved.
---
via perlbug: queue: perl5 status: new
https://rt.perl.org:443/rt3/Ticket/Display.html?id=41344
|
