Re: [viewvc-dev] running viewvc as a setuid cgi script
"Zvi Har'El" <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.viewcvs.devel |
|---|---|
| Organization | Technion--Israel Institute of Technology |
| Message-ID | <[email protected]> |
Yes. Checking further, I ran a small setuid shell scripts, entered to the CVS directory, and while the command "rlog file,v" produced correct output, the commad "co -p file,v" just gave me the error message "co: RCS/file,v: Permission denied". Of course file,v is readble by the effective user, and RCS/file,v doesn't exist! On 10/12/07 18:30, C. Michael Pilato wrote: > I don't know immediately of any reason why ViewVC simply can't work as a > setuid CGI script. (I mean, besides the tweak you already made.) Are you > running into permissions problems with the execution of some of the helper > binaries that ViewVC launches, in this case the RCS 'co' command? > > Zvi Har'El wrote: > >> Hi, >> >> >> Because of my syste, configuration, I need to run viewvc as a setuid cgi >> script. I created a small wrapper cgi which invokes viewvc with >> effective uid != the real uid, which is apache's uid. I immediatly >> encountered problem, because viewvc checks paths accessibility using the >> real uid, not the effective, one, so I patched the code as follows: >> >> >> --- lib/vclib/bincvs/__init__.py.~20070928091501~ 2007-09-28 >> 05:15:01.000000000 -0400 >> +++ lib/vclib/bincvs/__init__.py 2007-12-09 12:32:27.000000000 -0500 >> @@ -1026,7 +1026,7 @@ >> return kind, errors >> >> else: >> - _uid = os.getuid() >> + _uid = os.geteuid() >> _gid = os.getgid() >> >> def _check_path(pathname): >> >> >> It helped some, but not completely. I can view the whole CVS tree with >> the revision numbers etc, and also clicking on (annotate) in the log of >> each file. but, clicking on (view), gives me an exception trace, as follows: >> >> Traceback (most recent call last): >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main >> request.run_viewvc() >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc >> self.view_func(self) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 1368, in view_markup >> fp, revision = request.repos.openfile(path, rev) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile >> filename, revision = _parse_co_header(fp) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header >> raise COMalformedOutput, "Unable to find filename in co output stream" >> COMalformedOutput: Unable to find filename in co output stream >> >> (download) gives a a similar exception trace: >> >> >> Traceback (most recent call last): >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main >> request.run_viewvc() >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc >> self.view_func(self) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 2142, in view_checkout >> fp, revision = request.repos.openfile(path, rev) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile >> filename, revision = _parse_co_header(fp) >> File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header >> raise COMalformedOutput, "Unable to find filename in co output stream" >> COMalformedOutput: Unable to find filename in co output stream >> >> >> Should I pursue this, or do you see inherent problems in running viewvc >> as a setuid script? >> >> >> Best, >> >> >> Zvi >> >> > > > -- Dr. Zvi Har'El mailto:[email protected] Department of Mathematics tel:+972-54-4227607 Technion - Israel Institute of Technology fax:+972-4-8293388 http://www.math.technion.ac.il/~rl/ Haifa 32000, ISRAEL "If you can't say somethin' nice, don't say nothin' at all." -- Thumper (1942)