From: Lars Braeuer (lbraeuer_at_mpex.net)
Date: Sat 09 Nov 2002 - 17:50:07 GMT
is this just my fault or does "vserver <name> exec" remark that it's
run by a root suidperl script?
the interpreter used is suidperl (both script and suidperl executable
are mode 4755 / owner root.root).
here's the test script I'm using:
--snip-------------------------
#!/usr/bin/suidperl -T
## Security, clean up ENV ##
$ENV{'PATH'} = '/bin:/usr/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
$who = `whoami`;
print "Script running as: $who\n";
$exec = `/usr/sbin/vserver server1 exec whoami 2>&1`;
print "Exec output:\n$exec\n";
$t = `touch testfile`;
--/snap-------------------------
-rwsr-xr-x 2 root root 800943 Mar 23 2002 /usr/bin/suidperl*
-rws--s--x 1 root root 315 Nov 9 18:36 test.cgi*
-rw-r--r-- 1 root root 0 Nov 9 18:44 testfile
the output of the script, when run by a standard user:
--snip-------------------------
Script running as: root
Exec output:
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
SIOCSIFNETMASK: Permission denied
SIOCSIFBRDADDR: Permission denied
SIOCSIFFLAGS: Permission denied
/usr/lib/vserver/save_s_context: /var/run/vservers/customers.ctx:
Permission denied
Can't chroot to directory . (Operation not permitted)
--/snap-------------------------
the file "testfile" created using "touch" is user root group root.
when executing the script on the shell as root, it works, so the vserver
command doesn't seem to be executed as root.
is suidperl the problem? or is there something else to be checked/changed?
any suggestions and/or solutions are very welcome. ;)
lars