Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 271425 - www-servers/spawn-fcgi-1.6.2: lots of unnecessary environment variables being passed to php-cgi (env insecure)
Summary: www-servers/spawn-fcgi-1.6.2: lots of unnecessary environment variables being...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Server (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: www-servers Herd (OBSOLETE)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-05-27 15:55 UTC by Rory McGuire
Modified: 2009-07-03 21:17 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Rory McGuire 2009-05-27 15:55:43 UTC
Environment shouldn't be so full of system details and should contain the correct user as USER environment variable.


Reproducible: Always

Steps to Reproduce:
1. run spawn-fcgi with /usr/bin/php-cgi as the FCGI_PROGRAM
2. setup nginx to load a phpfile with the following content:
<pre><?php print_r($_SERVER); ?></pre>
3.

Actual Results:  
This is what PHP's $_SERVER variable has in it:
[MANPATH] => /usr/local/share/man:/usr/share/man:/usr/share/binutils-data/i686-pc-linux-gnu/2.19.1/man:/usr/share/gcc-data/i486-pc-linux-gnu/4.3.2/man:/usr/share/gcc-data/i686-pc-linux-gnu/4.3.3/man:/etc/java-config/system-vm/man/:/usr/lib/php5/man/:/usr/kde/4.2/share/man:/usr/kde/3.5/share/man:/usr/qt/3/doc/man
    [SHELL] => /bin/bash
    [TERM] => xterm
    [EINFO_LOG] => /etc/init.d/spawn-fcgi.local
    [QTDIR] => /usr/qt/3
    [ANT_HOME] => /usr/share/ant
    [USER] => root
    [PRELINK_PATH_MASK] => /usr/lib/klibc
    [GDK_USE_XFT] => 1
    [EINFO_LASTCMD] => eend
    [CONFIG_PROTECT_MASK] => /etc/gentoo-release /etc/sandbox.d /etc/env.d/java/ /etc/php/cli-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/udev/rules.d /etc/fonts/fonts.conf /etc/gconf /etc/terminfo /etc/ca-certificates.conf /etc/texmf/web2c /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/revdep-rebuild /etc/splash
    [RC_SVCNAME] => spawn-fcgi.local
    [XDG_CONFIG_DIRS] => /etc/xdg
    [PWD] => /
    [QMAKESPEC] => linux-g++
    [KDEDIRS] => /usr
    [SVCNAME] => spawn-fcgi.local
    [SHLVL] => 1
    [HOME] => /root
    [RC_SERVICE] => /etc/init.d/spawn-fcgi.local
    [GCC_SPECS] => 
    [CVS_RSH] => ssh
    [XDG_DATA_DIRS] => /usr/local/share:/usr/kde/4.2/share:/usr/kde/3.5/share:/usr/share:/usr/share/gdm
    [ROOTPATH] => /opt/bin:/usr/i486-pc-linux-gnu/gcc-bin/4.3.2:/usr/i686-pc-linux-gnu/gcc-bin/4.3.3:/usr/kde/4.2/sbin:/usr/kde/4.2/bin:/usr/kde/3.5/sbin:/usr/kde/3.5/bin:/usr/qt/3/bin
    [PKG_CONFIG_PATH] => /usr/kde/4.2/lib/pkgconfig:/usr/qt/3/lib/pkgconfig
    [LESSOPEN] => |lesspipe.sh %s
    [INFOPATH] => /usr/share/info:/usr/share/binutils-data/i686-pc-linux-gnu/2.19.1/info:/usr/share/gcc-data/i486-pc-linux-gnu/4.3.2/info:/usr/share/gcc-data/i686-pc-linux-gnu/4.3.3/info
    [USB_DEVFS_PATH] => /dev/bus/usb
    [OPENGL_PROFILE] => nvidia
    [SANE_CONFIG_DIR] => /etc/sane.d
    [_] => /bin/env
    [PATH] => /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
    [FCGI_ROLE] => RESPONDER
    [SCRIPT_FILENAME] => /home/rory/Documents/Programming/Netbeans Projects/Portal/www/index.php
    [QUERY_STRING] => 
    [REQUEST_METHOD] => GET
    [CONTENT_TYPE] => 
    [CONTENT_LENGTH] => 
    [SCRIPT_NAME] => /index.php
    [REQUEST_URI] => /blahablasdf
    [DOCUMENT_URI] => /index.php
    [DOCUMENT_ROOT] => /home/rory/Documents/Programming/Netbeans Projects/Portal/www
    [SERVER_PROTOCOL] => HTTP/1.1
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_SOFTWARE] => nginx/0.7.55
    [REMOTE_ADDR] => 127.0.0.1
    [REMOTE_PORT] => 3456
    [SERVER_ADDR] => 127.0.0.1
    [SERVER_PORT] => 80
    [SERVER_NAME] => portal
    [REDIRECT_STATUS] => 200
    [HTTP_HOST] => portal
    [HTTP_USER_AGENT] => Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009052218 Gentoo Firefox/3.0.10
    [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
    [HTTP_ACCEPT_ENCODING] => gzip,deflate
    [HTTP_ACCEPT_CHARSET] => UTF-8,*
    [HTTP_KEEP_ALIVE] => 300
    [HTTP_CONNECTION] => keep-alive
    [HTTP_CACHE_CONTROL] => max-age=0
    [PHP_SELF] => /index.php
    [REQUEST_TIME] => 1243438885
    [argv] => Array
        (
        )

    [argc] => 0
)




Expected Results:  
If I add -i to the env command @ /etc/init.d/spawn-fcgi line 26 so that:
    env ${E} /sbin/start-stop-daemon --start --pidfile ${P} --exec ${SPAWNFCGI} \

becomes:
    env -i ${E} /sbin/start-stop-daemon --start --pidfile ${P} --exec ${SPAWNFCGI} \


This is the resulting PHP $_SERVER variable:
Array
(
    [USER] => root
    [HOME] => /root
    [FCGI_ROLE] => RESPONDER
    [SCRIPT_FILENAME] => /home/rory/Documents/Programming/Netbeans Projects/Portal/www/index.php
    [QUERY_STRING] => 
    [REQUEST_METHOD] => GET
    [CONTENT_TYPE] => 
    [CONTENT_LENGTH] => 
    [SCRIPT_NAME] => /index.php
    [REQUEST_URI] => /blahablasdf
    [DOCUMENT_URI] => /index.php
    [DOCUMENT_ROOT] => /home/rory/Documents/Programming/Netbeans Projects/Portal/www
    [SERVER_PROTOCOL] => HTTP/1.1
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_SOFTWARE] => nginx/0.7.55
    [REMOTE_ADDR] => 127.0.0.1
    [REMOTE_PORT] => 3675
    [SERVER_ADDR] => 127.0.0.1
    [SERVER_PORT] => 80
    [SERVER_NAME] => portal
    [REDIRECT_STATUS] => 200
    [HTTP_HOST] => portal
    [HTTP_USER_AGENT] => Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009052218 Gentoo Firefox/3.0.10
    [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
    [HTTP_ACCEPT_ENCODING] => gzip,deflate
    [HTTP_ACCEPT_CHARSET] => UTF-8,*
    [HTTP_KEEP_ALIVE] => 300
    [HTTP_CONNECTION] => keep-alive
    [HTTP_CACHE_CONTROL] => max-age=0
    [PHP_SELF] => /index.php
    [REQUEST_TIME] => 1243439194
    [argv] => Array
        (
        )

    [argc] => 0
)



This still states that HOME is /root, and USER is root even though in my /etc/conf.d/spawn-fcgi.local config file I have set the user to webdev.
Comment 1 Thilo Bangert (RETIRED) (RETIRED) gentoo-dev 2009-07-03 21:17:05 UTC
fixed in cvs. thanks for the report