Re: [viewvc-dev] running viewvc as a setuid cgi script

I don't know immediately of any reason why ViewVC simply can't work as a
setuid CGI script.  (I mean, besides the tweak you already made.)  Are you
running into permissions problems with the execution of some of the helper
binaries that ViewVC launches, in this case the RCS 'co' command?

Zvi Har'El wrote:
> Hi,
> 
> 
> Because of my syste, configuration, I need to run viewvc as a setuid cgi
> script. I created a small wrapper cgi which invokes viewvc with
> effective uid != the real uid, which is apache's uid. I immediatly
> encountered problem, because viewvc checks paths accessibility using the
> real uid, not the effective, one, so I patched the code as follows:
> 
> 
> --- lib/vclib/bincvs/__init__.py.~20070928091501~       2007-09-28
> 05:15:01.000000000 -0400
> +++ lib/vclib/bincvs/__init__.py        2007-12-09 12:32:27.000000000 -0500
> @@ -1026,7 +1026,7 @@
>      return kind, errors
>  
>  else:
> -  _uid = os.getuid()
> +  _uid = os.geteuid()
>    _gid = os.getgid()
>  
>    def _check_path(pathname):
> 
> 
> It helped some, but not completely. I can view the whole CVS tree with
> the revision numbers etc, and also clicking on (annotate) in the log of
> each file. but, clicking on (view), gives me an exception trace, as follows:
> 
> Traceback (most recent call last):
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main
>     request.run_viewvc()
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc
>     self.view_func(self)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 1368, in view_markup
>     fp, revision = request.repos.openfile(path, rev)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile
>     filename, revision = _parse_co_header(fp)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header
>     raise COMalformedOutput, "Unable to find filename in co output stream"
> COMalformedOutput: Unable to find filename in co output stream
> 
> (download) gives a a similar exception trace:
> 
> 
> Traceback (most recent call last):
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main
>     request.run_viewvc()
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc
>     self.view_func(self)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 2142, in view_checkout
>     fp, revision = request.repos.openfile(path, rev)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile
>     filename, revision = _parse_co_header(fp)
>   File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header
>     raise COMalformedOutput, "Unable to find filename in co output stream"
> COMalformedOutput: Unable to find filename in co output stream
> 
> 
> Should I pursue this, or do you see inherent problems in running viewvc
> as a setuid script?
> 
> 
> Best,
> 
> 
> Zvi
> 


-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHXWm+okEGqRcG/W4RAollAJ91jvl29C+bMRv6nQ10wr+8FNDCXQCfRa1s
p6kNR8FgEn34Q43c8rh9r3E=
=TyKw
-----END PGP SIGNATURE-----