#23674 [NEW]: PHP thinks it is root

From: cryo at diku dot dk Operating system: Linux (kernel 2.4.20, gcc 3.2.2) PHP version: 4.3.1 PHP Bug Type: PHP options/info functions Bug description: PHP thinks it is root When running apache as usual, ie. started as root and with configuration directives User apache and Group apache, the parent apache process continues to run as root, as per the apache manual. When invoking any of the get_myuid, get_mygid etc. functions however, they always return 0 ie. the root user, which is what the parent process runs under. If you try to perform any file operation however, it is clear that PHP is really NOT root, since it fails unless the file is owned or accessible by the apache user or group. This has a serious impact on safe_mode, as php then checks every file you work with if it's owned by root. Finding that it isn't, it aborts the operation. If it IS owned by root, then apache goes ahead and fails with permission denied, since PHP is still not root and never will be. I made a PHP script which first displayed the getmyuid() and getmygid() values, and then (using back pings) ran a program which printed out its own uid, gid, euid and egid. The result: Running as 0/0 (user root). Results from iddump: User id : 81 Group id: 81 Effective user id : 81 Effective group id: 81 uid/gid 81 would be the apache user/group. I guess the bug is somewhat caused by the parent process of apache running as root:root, but then again, as is also evident when performing file operations, PHP really is NOT running as the user/group it thinks. My apache info: Server Version: Apache/1.3.27 (Unix) (Gentoo/Linux) mod_ssl/2.8.14 OpenSSL/0.9.6i PHP/4.3.1 My PHP configuration is as follows: ./configure' '--prefix=/usr' '--with-bz2' '--enable- ftp' '--enable-force-cgi-redirect' '--enable-discard- path' '--enable-mime-magic' '--enable-wddx' '--enable- dbase' '--with-zlib=yes' '--with-iconv' '--enable- bcmath' '--enable-sysvsem' '--enable-exif' '--enable- sysvshm' '--enable-sockets' '--enable-calendar' '-- enable-trans-sid' '--enable-safe-mode' '--enable- versioning' '--enable-track-vars' '--enable-inline- optimization' '--with-config-file-path=/etc/php4' '-- host=i686-pc-linux-gnu' '--without-readline' '--with- pam' '--with-gettext' '--with-openssl' '--with-gdbm=/ usr' '--with-db3=/usr' '--with-mysql=/usr' '--with- jpeg-dir=/usr' '--with-pspell' '--with-png-dir=/usr' '--with-zlib' '--with-zlib-dir=/usr/lib' '--with-exec- dir=/usr/bin' '--with-apxs=/usr/sbin/apxs' '--with-xml' '--with-dom' '--with-mcrypt' '--with-mhash' '--disable posix-threads' -- Edit bug report at http://bugs.php.net/?id=23674&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23674&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23674&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23674&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23674&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23674&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23674&r=support Expected behavior: http://bugs.php.net/fix.php?id=23674&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23674&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23674&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23674&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23674&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23674&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23674&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23674&r=gnused