#49827 [NEW]: shell_exec using ls /home fails with Permission denied

From: bill dot mcclendon at digiconllc dot com Operating system: Linux RH PHP version: 5.2.11 PHP Bug Type: Unknown/Other Function Bug description: shell_exec using ls /home fails with Permission denied Description: ------------ Running Apache 2.x and PHP 5.2 safe_mode = off test case - using "<?php $cmd = 'ls /home'; shell_exec($cmd); ?>" produces the error "ls: /home Permission denied" using "<?php $cmd = 'ls /usr'; shell_exec($cmd); ?>" succeeds (check the Apache error_log for errors) However, both "/home" and "/usr" have the EXACT same permission and ownership. and Apache is running with "User owner" where "owner" is the owner of the contents of "/home". Listing of both paths: 8 drwxr-xr-x 15 root root 4096 Jun 24 2005 usr 8 drwxr-xr-x 5 root root 4096 Jan 8 2007 home Shell is "/bin/bash" and it looks like: 764 -rwxr-xr-x 1 root root 772760 Dec 6 2004 /bin/bash Any ideas? Reproduce code: --------------- Test cases: FAIL: <?php $cmd = 'ls /home'; echo "<pre>".shell_exec($cmd)."</pre>"; ?> SUCCESS: <?php $cmd = 'ls /usr'; echo "<pre>".shell_exec($cmd)."</pre>"; ?> Expected result: ---------------- Listing of files: SUCCESS result: bin etc games include kerberos lib lib64 libexec local sbin share src tmp X11R6 Actual result: -------------- For FAIL above (no results). -- Edit bug report at http://bugs.php.net/?id=49827&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=49827&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=49827&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=49827&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=49827&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=49827&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=49827&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=49827&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=49827&r=needscript Try newer version: http://bugs.php.net/fix.php?id=49827&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=49827&r=support Expected behavior: http://bugs.php.net/fix.php?id=49827&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=49827&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=49827&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=49827&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=49827&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=49827&r=dst IIS Stability: http://bugs.php.net/fix.php?id=49827&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=49827&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=49827&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=49827&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=49827&r=mysqlcfg