#49049 [Fbk->Opn]: file_exists() under unprivileged user with set user ID on execution fails

ID: 49049 User updated by: rusxakep at gmail dot com Reported By: rusxakep at gmail dot com -Status: Feedback +Status: Open Bug Type: Filesystem function related Operating System: Linux 2.6.29 PHP Version: 5.2.10 New Comment: Jani, Is bug reproducing ONLY with using "set execution bit"! Simple way test with strace output: 1. Temprorarly set "chmod 6755" to /usr/bin/strace binary for correct test. 2. Create simple CONSOLE test.php file and place to /home/1/ directory (owner should be root.root): #!/usr/bin/php -q <?php if (!file_exists("/home/1/2/3")) mkdir("/home/1/2/3",0700,true); ?> 3. Run this script under any unprivileged user with next cmd: "su - someuser -c "/usr/bin/strace /home/1/test.php" First run test.php create directory /home/1/2 and /home/1/2/3 successfully with "someuser" owner and 0700. Second run test.php script must be finish w/o any messages, because directory already exists, but function file_exists() incorrectly fulfils and produces that the directory does not exist, though it is. Try it! If something else is not clear, I will explain more in detail. Previous Comments: ------------------------------------------------------------------------ [2009-07-28 19:52:47] jani@php.net Your report is quite confusing. You talk about creating /home/user/2/3 directories (note the missing 1?) but your straces show quite different outputs. Please, come up with _simple_ way to reproduce this. Simple meaning ONE php (and PHP ONLY!) file. ------------------------------------------------------------------------ [2009-07-27 09:19:12] rusxakep at gmail dot com Added -D__USE_FILE_OFFSET64 to CFLAGS and re-compile all php stuff. Example of compilation (correct?): "/bin/sh /var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/libtool --silent --preserve-dup-deps --mode=compile i686-pc-linux-gnu-gcc -IZend/ -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend/ -DPHP_ATOM_INC -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/include -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/main -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430 -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/date/lib -I/usr/include/libxml2 -I/usr/include/freetype2 -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/oniguruma -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/libmbfl -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/libmbfl/mbfl -I/usr/include/mysql -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/TSRM -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend -I/usr/include -march=pentium4 -O2 -fomit-frame-pointer -pipe -D_GNU_SOURCE -D__USE_FILE_OFFSET64 -prefer-non-pic -c /var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend/zend_objects.c -o Zend/zend_objects.lo /bin/sh /var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/libtool --silent --preserve-dup-deps --mode=compile i686-pc-linux-gnu-gcc -IZend/ -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend/ -DPHP_ATOM_INC -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/include -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/main -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430 -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/date/lib -I/usr/include/libxml2 -I/usr/include/freetype2 -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/oniguruma -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/libmbfl -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/ext/mbstring/libmbfl/mbfl -I/usr/include/mysql -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/TSRM -I/var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend -I/usr/include -march=pentium4 -O2 -fomit-frame-pointer -pipe -D_GNU_SOURCE -D__USE_FILE_OFFSET64 -prefer-non-pic -c /var/tmp/portage/dev-lang/php-5.2.99/work/php5.2-200907241430/Zend/zend_object_handlers.c -o Zend/zend_object_handlers.lo" My problem not resolved yet :( access("/home/1/2/3", F_OK) = -1 EACCES (Permission denied) stat64("/home/1/2", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 mkdir("/home/1/2/3", 0700) = -1 EEXIST (File exists) write(1, "\nWarning: mkdir(): File exists in"..., 61 Warning: mkdir(): File exists in /home/1/test.php on line 3 ) = 61) ------------------------------------------------------------------------ [2009-07-26 12:02:56] jani@php.net Did you or did you not compile using the LFS flags? ------------------------------------------------------------------------ [2009-07-25 20:20:52] rusxakep at gmail dot com No, isn't LFS bug. I'm run test php from LFS bug notes. mkdir working fine. Directory has been created successfully.) ------------------------------------------------------------------------ [2009-07-24 17:10:09] jani@php.net Would you please just do what I asked and try compile with LFS flags..? I'm quite sure this is same issue as in that other bug. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/49049 -- Edit this bug report at http://bugs.php.net/?id=49049&edit=1