Re: mutilog via fifo

On Sun, 03 Aug 2008 13:24:03 -0400
[email protected] (Paul Jarc) wrote:

> richard lucassen <[email protected]> wrote:
> > I think the user qftp has no write access to stderr.
> 
> Access checks only happen for open(), not read() or write().  So it's
> not a permissions problem.  Try a system call trace to see what elhttp
> is doing.

It is an permission problem:

open("/dev/stderr", O_RDWR|O_APPEND|O_CREAT, 0666) = -1 EACCES
(Permission denied)

#!/bin/sh
exec 2>&1
exec /usr/local/bin/envuidgid elhttp /usr/local/bin/tcpserver -vDRHl0 -U
-c100 0 8088 strace -o /tmp/strace -ff /usr/local/bin/elhttp 0 0.0.0.0
0.0.0.0 "/dev/stderr" 1

> > When publicfile is invoked by tcpserver, it runs as user qftp. When
> > elhttp is invoked by tcpserver this way, it runs as root.
> >
> > Why is that?
> 
> pf-httpd switches itself to the user and group specified in $UID and
> $GID (after chrooting, which can only be done as root).

So publicfile is started as root, and thus has access to /dev/stderr,
and after that changes uid/gid. Right or wrong?

R.

-- 
___________________________________________________________________
It is better to remain silent and be thought a fool, than to speak
aloud and remove all doubt.

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht                                        |
| Public key and email address:                                    |
| http://www.lucassen.org/mail-pubkey.html                         |
+------------------------------------------------------------------+