Re: Outstanding question

adam morley <[email protected]>:

> # nc localhost 80
> uid=0(root) gid=0(root)
> # cat /home/public/httpd/run 
> #!/bin/sh
> exec 2>&1
> exec envuidgid ftp softlimit -o20 -d50000 tcpserver -vDRHl0 -b50 -c100 0 80 /usr/bin/id

everything as expected.

> Looks to me like httpd does do the proper setuid32 and setgid32
> calls, but id does not.  Why?  Well, I looked at main.c from
> publicfile-0.52, and I found it was doing some testing with gid/uid,
> so I'm guessing thats where the setuid/setgid happen (but I could be
> wrong)

everything as expected.  id(1) outputs the UID of the caller, it
doesn't reset them.  httpd/ftpd see the variables $UID/$GID in their
environment, put there by envuidgid(1).  tcpserver starts them as
root, and they are responsible for checking the environment and
dropping privileges to theappropriate values.  this is done in the
common part of httpd/ftpd described in main.c.

  clemens