#49049 [Opn]: file_exists under unprivileged user with set user ID on execution fails

From: Date: Fri, 24 Jul 2009 15:32:30 +0000
Subject: #49049 [Opn]: file_exists under unprivileged user with set user ID on execution fails
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-140202@lists.php.net to get a copy of this message 
 ID:               49049
 User updated by:  rusxakep at gmail dot com
 Reported By:      rusxakep at gmail dot com
 Status:           Open
 Bug Type:         Filesystem function related
 Operating System: Linux 2.6.29
 PHP Version:      5.2.10
 New Comment:

Last snapshot tested. Same problem

With "/home/1/2" working, but "/home/1/2/3" doesn't worked.

:(

PHP 5.2.11-pl0-gentoo (cli) (built: Jul 24 2009 19:26:18)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies

Linux mail 2.6.29-gentoo-r5 #1 SMP Tue Jul 14 13:16:20 MSD 2009 i686
Intel(R) Xeon(R) CPU E5310 @ 1.60GHz GenuineIntel GNU/Linux


Previous Comments:
------------------------------------------------------------------------

[2009-07-24 15:00:45] rusxakep at gmail dot com

If you reduce path to "/home/user/2", then working fine.)

------------------------------------------------------------------------

[2009-07-24 14:57:41] rusxakep at gmail dot com

Description:
------------
1. Create and save to /home/user this next short program:
#define REAL_PATH "/home/user/test.php"
main(ac, av)
     char **av;
{
  execv(REAL_PATH, av);
}

2. Compile cc -o test test.c
3. chown root.root test and chmod 6755 test
5. Create test.php
#!/usr/bin/php-cgi -q
<?php
if (!file_exists("/home/user/2/3")) mkdir
("/home/user/2/3",0700,true);
?>
6. chown root.root test.php and chmod 0755 test.php
7. chmod 1777 /home/user
7. run with any unprivileged user:
su - user -c "/home/user/test"

First run ok, creating directory with root access
Second run failed with next error message:

Warning: mkdir(): File exists in /home/user/test.php on line 3

Reproduce code:
---------------
no safe mode, default php.ini

Expected result:
----------------
Empty exit w/o warning

Actual result:
--------------
Warning: mkdir(): File exists in /home/user/test.php on line 3


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=49049&edit=1

Thread (21 messages)

« previous php.bugs (#140202) next »