#19363 [Fbk->NoF]: PHP safe mode security problem

ID: 19363 Updated by: php-bugs@lists.php.net Reported By: dados@impazz.it -Status: Feedback +Status: No Feedback Bug Type: Filesystem function related Operating System: Linux 2.4.2-2smp PHP Version: 4.2.2 New Comment: No feedback was provided for this bug for over 2 weeks, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". Previous Comments: ------------------------------------------------------------------------ [2002-10-28 10:56:12] iliaa@php.net Please try using this CVS snapshot: http://snaps.php.net/php4-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-latest.zip ------------------------------------------------------------------------ [2002-09-11 19:52:41] dados@impazz.it Upgraded to php 4.3.3 --> still having the same problem ------------------------------------------------------------------------ [2002-09-11 18:57:50] dados@impazz.it Hello, using apache 1.3.26, I have safe mode on I have a simple single-line script: safemode.php <?print_r($fp = fopen('newsletter.html', 'r'));?> safemode is owned by wbr:wbr and newsletter.html is owned by root:root as you can see -rw-r--r-- 1 root root 22161 Sep 12 00:17 newsletter.html -rw-r--r-- 1 wbr wbr 43 Sep 12 01:24 safemode.php safemode.php execution simply return 'Resource id #1' without errors related to safe mode, even if the owner of the files is not the same If I change the owner of safemode.php $ chown nobody:nobody safemode.php and reload safemode.php I get the expected warning: Warning: SAFE MODE Restriction in effect. The script whose uid is 99 is not allowed to access newsletter.html owned by uid If I change the user back to wbr:wbr --> No warning Helpful info: $ cat /etc/passwd |grep wbr wbr:x:501:501::/www/wbr:/bin/bash $ cat /usr/local/lib/php.ini |grep safe_mode |grep -v "^;" safe_mode = On safe_mode_gid = Off safe_mode_include_dir = "/usr/local/lib/php" safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH sql.safe_mode = Off Hope can help Thanks a lot Edoardo Serra ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=19363&edit=1