#23674 [Opn->Bgs]: PHP thinks it is root

ID: 23674 Updated by: sniper@php.net Reported By: cryo at diku dot dk -Status: Open +Status: Bogus Bug Type: PHP options/info functions Operating System: Linux (kernel 2.4.20, gcc 3.2.2) PHP Version: 4.3.1 New Comment: This script: <?php echo getmyuid(); echo "<br>"; echo getmygid(); ?> Outputs: 501 501 (user/group: nobody) So you're just doing something wrong. And in any case not possibly a PHP bug.. Previous Comments: ------------------------------------------------------------------------ [2003-05-17 19:06:51] cryo at diku dot dk When running apache as usual, ie. started as root and with configuration directives User apache and Group apache, the parent apache process continues to run as root, as per the apache manual. When invoking any of the get_myuid, get_mygid etc. functions however, they always return 0 ie. the root user, which is what the parent process runs under. If you try to perform any file operation however, it is clear that PHP is really NOT root, since it fails unless the file is owned or accessible by the apache user or group. This has a serious impact on safe_mode, as php then checks every file you work with if it's owned by root. Finding that it isn't, it aborts the operation. If it IS owned by root, then apache goes ahead and fails with permission denied, since PHP is still not root and never will be. I made a PHP script which first displayed the getmyuid() and getmygid() values, and then (using back pings) ran a program which printed out its own uid, gid, euid and egid. The result: Running as 0/0 (user root). Results from iddump: User id : 81 Group id: 81 Effective user id : 81 Effective group id: 81 uid/gid 81 would be the apache user/group. I guess the bug is somewhat caused by the parent process of apache running as root:root, but then again, as is also evident when performing file operations, PHP really is NOT running as the user/group it thinks. My apache info: Server Version: Apache/1.3.27 (Unix) (Gentoo/Linux) mod_ssl/2.8.14 OpenSSL/0.9.6i PHP/4.3.1 My PHP configuration is as follows: ./configure' '--prefix=/usr' '--with-bz2' '--enable- ftp' '--enable-force-cgi-redirect' '--enable-discard- path' '--enable-mime-magic' '--enable-wddx' '--enable- dbase' '--with-zlib=yes' '--with-iconv' '--enable- bcmath' '--enable-sysvsem' '--enable-exif' '--enable- sysvshm' '--enable-sockets' '--enable-calendar' '-- enable-trans-sid' '--enable-safe-mode' '--enable- versioning' '--enable-track-vars' '--enable-inline- optimization' '--with-config-file-path=/etc/php4' '-- host=i686-pc-linux-gnu' '--without-readline' '--with- pam' '--with-gettext' '--with-openssl' '--with-gdbm=/ usr' '--with-db3=/usr' '--with-mysql=/usr' '--with- jpeg-dir=/usr' '--with-pspell' '--with-png-dir=/usr' '--with-zlib' '--with-zlib-dir=/usr/lib' '--with-exec- dir=/usr/bin' '--with-apxs=/usr/sbin/apxs' '--with-xml' '--with-dom' '--with-mcrypt' '--with-mhash' '--disable posix-threads' ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=23674&edit=1