Bug 303795 – Make it possible to disable parent directory owner check in www-apache/mod_suphp

• Status: RESOLVED UPSTREAM
• Product: Gentoo Linux

[Description Candid Dauth 2010-02-06 20:31:35 UTC]

mod_suphp 0.6.3 introduced a new “security” feature that checks the parent directory of an executed file to match the file’s owner. This is undesirable in many cases. I have found a patch to add a new configuration parameter for this on http://bashcurescancer.com/media/suphp-0.6.3-parent-directory-ownership.patch and changed it to be applicable for mod_suphp-0.7.1.

Reproducible: Always

Steps to Reproduce:

[Comment 1 Candid Dauth 2010-02-06 20:35:24 UTC]

Created attachment 218719 [details, diff]
Patch on the sources to add the new configuration value.

[Comment 2 Candid Dauth 2010-02-06 20:38:19 UTC]

Created attachment 218721 [details, diff]
Patch on the ebuild to add the suphp patch.

[Comment 3 Candid Dauth 2010-02-06 20:39:58 UTC]

Created attachment 218725 [details, diff]
Patch on the default config file to add the new setting.

[Comment 4 Candid Dauth 2010-02-06 21:15:04 UTC]

Created attachment 218743 [details, diff]
Patch on the sources to add the new configuration value.

I updated the patch on the sources, the old one did not quite do what I thought it did. This one definitely works for me.

[Comment 5 Candid Dauth 2010-02-06 21:16:48 UTC]

Created attachment 218745 [details, diff]
Patch on the default config file to add the new setting.

I updated the patch on the config file to better describe the setting.

[Comment 6 Doktor Notor 2010-02-21 21:46:59 UTC]

As you noted, this has been like this since 0.6.3, released 2008-03-30 - that's just short of two years (!). Similar patches which affect important security features need to be taken upstream - https://lists.marsching.com/mailman/listinfo/suphp, otherwise you end up with shopping something that is completely unsupported by upstream and forward-porting all that unsupported stuff from version to version when it breaks.

[Comment 7 Candid Dauth 2010-02-27 19:23:04 UTC]

I agree with you, but obviously the suphp developers don’t have any interest in including this patch (as I found it on that mailing list, and similar ones have been posted there many times). In my opinion, this “security feature” is a bug, and I think it should be fixed somewhere.

I don’t understand what you are trying to tell me by pointing out that this “feature” has been introduced in 2008. 0.6.2 has been removed from the Portage tree last September, and updating completely breaks many existing configurations.

[Comment 8 Pacho Ramos 2012-12-15 17:41:01 UTC]

This needs to be fixed by upstream