cvs: php4 / php.ini-dist php.ini-optimized /ext/standard basic_functions.c basic_functions.h pageinfo.c pageinfo.h /main main.c php_globals.h
safe_mode.c
| From: | Rasmus Lerdorf | Date: | Mon, 09 Jul 2001 17:36:05 +0000 |
| Subject: | cvs: php4 / php.ini-dist php.ini-optimized /ext/standard basic_functions.c basic_functions.h pageinfo.c pageinfo.h /main main.c php_globals.h safe_mode.c |
||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-6131@lists.php.net to get a copy of this message | ||
rasmus Mon Jul 9 13:36:05 2001 EDT
Modified files:
/php4 php.ini-dist php.ini-optimized
/php4/ext/standard basic_functions.c basic_functions.h pageinfo.c
pageinfo.h
/php4/main main.c php_globals.h safe_mode.c
Log:
Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
a gid check instead of a uid check.
@ - Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
@ a gid check instead of a uid check. (James E. Flemer, Rasmus)
Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.86 php4/php.ini-dist:1.87 --- php4/php.ini-dist:1.86 Tue Jul 3 23:53:12 2001 +++ php4/php.ini-dist Mon Jul 9 13:36:03 2001 @@ -1,5 +1,5 @@ [PHP] -; $Id: php.ini-dist,v 1.86 2001/07/04 03:53:12 rasmus Exp $ +; $Id: php.ini-dist,v 1.87 2001/07/09 17:36:03 rasmus Exp $ ;;;;;;;;;;;;;;;;;;; ; About this file ; @@ -111,11 +111,16 @@ ; safe_mode = Off +; By default, Safe Mode does a UID compare check when +; opening files. If you want to relax this to a GID compare, +; then turn on safe_mode_gid. +safe_mode_gid = Off + ; When safe_mode is on, only executables located in the safe_mode_exec_dir ; will be allowed to be executed via the exec family of functions. safe_mode_exec_dir = -; open_basedir if set limits all file operations to the defined directory +; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. ; Index: php4/php.ini-optimized diff -u php4/php.ini-optimized:1.40 php4/php.ini-optimized:1.41 --- php4/php.ini-optimized:1.40 Sun Jun 24 18:40:41 2001 +++ php4/php.ini-optimized Mon Jul 9 13:36:03 2001 @@ -81,6 +81,10 @@ ; Safe Mode safe_mode = Off +safe_mode_gid = Off ; By default, Safe Mode does a UID compare + ; check when opening files. If you want to + ; relax this to a GID compare, then turn on + ; safe_mode_gid. safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ ; Setting certain environment variables ; may be a potential security breach. Index: php4/ext/standard/basic_functions.c diff -u php4/ext/standard/basic_functions.c:1.357 php4/ext/standard/basic_functions.c:1.358 --- php4/ext/standard/basic_functions.c:1.357 Mon Jul 9 06:20:40 2001 +++ php4/ext/standard/basic_functions.c Mon Jul 9 13:36:03 2001 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.c,v 1.357 2001/07/09 10:20:40 thies Exp $ */ +/* $Id: basic_functions.c,v 1.358 2001/07/09 17:36:03 rasmus Exp $ */ #include "php.h" #include "php_main.h" @@ -268,6 +268,7 @@ #endif PHP_FE(getmyuid, NULL) + PHP_FE(getmygid, NULL) PHP_FE(getmypid, NULL) PHP_FE(getmyinode, NULL) PHP_FE(getlastmod, NULL) @@ -846,6 +847,7 @@ BG(mmap_file) = NULL; #endif BG(page_uid) = -1; + BG(page_gid) = -1; BG(page_inode) = -1; BG(page_mtime) = -1; #ifdef HAVE_PUTENV Index: php4/ext/standard/basic_functions.h diff -u php4/ext/standard/basic_functions.h:1.80 php4/ext/standard/basic_functions.h:1.81 --- php4/ext/standard/basic_functions.h:1.80 Tue May 22 15:19:04 2001 +++ php4/ext/standard/basic_functions.h Mon Jul 9 13:36:04 2001 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.h,v 1.80 2001/05/22 19:19:04 andi Exp $ */ +/* $Id: basic_functions.h,v 1.81 2001/07/09 17:36:04 rasmus Exp $ */ #ifndef BASIC_FUNCTIONS_H #define BASIC_FUNCTIONS_H @@ -155,6 +155,7 @@ /* pageinfo.c */ long page_uid; + long page_gid; long page_inode; long page_mtime; Index: php4/ext/standard/pageinfo.c diff -u php4/ext/standard/pageinfo.c:1.23 php4/ext/standard/pageinfo.c:1.24 --- php4/ext/standard/pageinfo.c:1.23 Wed Jun 6 09:05:51 2001 +++ php4/ext/standard/pageinfo.c Mon Jul 9 13:36:04 2001 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pageinfo.c,v 1.23 2001/06/06 13:05:51 rasmus Exp $ */ +/* $Id: pageinfo.c,v 1.24 2001/07/09 17:36:04 rasmus Exp $ */ #include "php.h" #include "pageinfo.h" @@ -49,9 +49,10 @@ pstat = sapi_get_stat(); - if (BG(page_uid)==-1) { + if (BG(page_uid)==-1 || BG(page_gid)==-1) { if(pstat) { BG(page_uid) = pstat->st_uid; + BG(page_gid) = pstat->st_gid; BG(page_inode) = pstat->st_ino; BG(page_mtime) = pstat->st_mtime; } @@ -70,6 +71,14 @@ } /* }}} */ +long php_getgid(void) +{ + BLS_FETCH(); + + php_statpage(BLS_C); + return (BG(page_gid)); +} + /* {{{ proto int getmyuid(void) Get PHP script owner's UID */ PHP_FUNCTION(getmyuid) @@ -81,6 +90,21 @@ RETURN_FALSE; } else { RETURN_LONG(uid); + } +} +/* }}} */ + +/* {{{ proto int getmygid(void) + Get PHP script owner's GID */ +PHP_FUNCTION(getmygid) +{ + long gid; + + gid = php_getgid(); + if (gid < 0) { + RETURN_FALSE; + } else { + RETURN_LONG(gid); } } /* }}} */ Index: php4/ext/standard/pageinfo.h diff -u php4/ext/standard/pageinfo.h:1.6 php4/ext/standard/pageinfo.h:1.7 --- php4/ext/standard/pageinfo.h:1.6 Mon Feb 26 01:07:23 2001 +++ php4/ext/standard/pageinfo.h Mon Jul 9 13:36:04 2001 @@ -16,16 +16,18 @@ +----------------------------------------------------------------------+ */ -/* $Id: pageinfo.h,v 1.6 2001/02/26 06:07:23 andi Exp $ */ +/* $Id: pageinfo.h,v 1.7 2001/07/09 17:36:04 rasmus Exp $ */ #ifndef PAGEINFO_H #define PAGEINFO_H PHP_FUNCTION(getmyuid); +PHP_FUNCTION(getmygid); PHP_FUNCTION(getmypid); PHP_FUNCTION(getmyinode); PHP_FUNCTION(getlastmod); extern long php_getuid(void); +extern long php_getgid(void); #endif Index: php4/main/main.c diff -u php4/main/main.c:1.371 php4/main/main.c:1.372 --- php4/main/main.c:1.371 Mon Jul 2 14:17:09 2001 +++ php4/main/main.c Mon Jul 9 13:36:04 2001 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: main.c,v 1.371 2001/07/02 18:17:09 zeev Exp $ */ +/* $Id: main.c,v 1.372 2001/07/09 17:36:04 rasmus Exp $ */ /* {{{ includes */ @@ -213,6 +213,7 @@ STD_PHP_INI_BOOLEAN("register_argc_argv", "1", PHP_INI_ALL, OnUpdateBool, register_argc_argv, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("register_globals", "1", PHP_INI_ALL, OnUpdateBool, register_globals, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode, php_core_globals, core_globals) + STD_PHP_INI_BOOLEAN("safe_mode_gid", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode_gid, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("short_open_tag",DEFAULT_SHORT_OPEN_TAG, PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateBool, short_tags, zend_compiler_globals, compiler_globals) STD_PHP_INI_BOOLEAN("sql.safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, sql_safe_mode, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("track_errors", "0", PHP_INI_ALL, OnUpdateBool, track_errors, php_core_globals, core_globals) Index: php4/main/php_globals.h diff -u php4/main/php_globals.h:1.63 php4/main/php_globals.h:1.64 --- php4/main/php_globals.h:1.63 Wed Apr 4 16:46:26 2001 +++ php4/main/php_globals.h Mon Jul 9 13:36:04 2001 @@ -68,6 +68,7 @@ zend_bool implicit_flush; zend_bool safe_mode; + zend_bool safe_mode_gid; zend_bool sql_safe_mode; zend_bool enable_dl; Index: php4/main/safe_mode.c diff -u php4/main/safe_mode.c:1.30 php4/main/safe_mode.c:1.31 --- php4/main/safe_mode.c:1.30 Wed Jun 6 09:05:53 2001 +++ php4/main/safe_mode.c Mon Jul 9 13:36:04 2001 @@ -15,7 +15,7 @@ | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: safe_mode.c,v 1.30 2001/06/06 13:05:53 rasmus Exp $ */ +/* $Id: safe_mode.c,v 1.31 2001/07/09 17:36:04 rasmus Exp $ */ #include "php.h" @@ -29,6 +29,7 @@ #include "ext/standard/pageinfo.h" #include "safe_mode.h" #include "SAPI.h" +#include "php_globals.h" /* @@ -46,7 +47,7 @@ { struct stat sb; int ret; - long uid=0L, duid=0L; + long uid=0L, gid=0L, duid=0L, dgid=0L; char *s; if (!filename) { @@ -120,6 +121,8 @@ } if (duid == (uid=php_getuid())) { return 1; + } else if (PG(safe_mode_gid) && dgid == (gid=php_getgid())) { + return 1; } else { SLS_FETCH(); @@ -129,7 +132,11 @@ } } - php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid); + if (PG(safe_mode_gid)) { + php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid/gid is %ld/%ld is not allowed to access %s owned by uid/gid %ld/%ld", uid, gid, filename, duid, dgid); + } else { + php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid); + } return 0; } }
Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.86 php4/php.ini-dist:1.87 --- php4/php.ini-dist:1.86 Tue Jul 3 23:53:12 2001 +++ php4/php.ini-dist Mon Jul 9 13:36:03 2001 @@ -1,5 +1,5 @@ [PHP] -; $Id: php.ini-dist,v 1.86 2001/07/04 03:53:12 rasmus Exp $ +; $Id: php.ini-dist,v 1.87 2001/07/09 17:36:03 rasmus Exp $ ;;;;;;;;;;;;;;;;;;; ; About this file ; @@ -111,11 +111,16 @@ ; safe_mode = Off +; By default, Safe Mode does a UID compare check when +; opening files. If you want to relax this to a GID compare, +; then turn on safe_mode_gid. +safe_mode_gid = Off + ; When safe_mode is on, only executables located in the safe_mode_exec_dir ; will be allowed to be executed via the exec family of functions. safe_mode_exec_dir = -; open_basedir if set limits all file operations to the defined directory +; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. ; Index: php4/php.ini-optimized diff -u php4/php.ini-optimized:1.40 php4/php.ini-optimized:1.41 --- php4/php.ini-optimized:1.40 Sun Jun 24 18:40:41 2001 +++ php4/php.ini-optimized Mon Jul 9 13:36:03 2001 @@ -81,6 +81,10 @@ ; Safe Mode safe_mode = Off +safe_mode_gid = Off ; By default, Safe Mode does a UID compare + ; check when opening files. If you want to + ; relax this to a GID compare, then turn on + ; safe_mode_gid. safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ ; Setting certain environment variables ; may be a potential security breach. Index: php4/ext/standard/basic_functions.c diff -u php4/ext/standard/basic_functions.c:1.357 php4/ext/standard/basic_functions.c:1.358 --- php4/ext/standard/basic_functions.c:1.357 Mon Jul 9 06:20:40 2001 +++ php4/ext/standard/basic_functions.c Mon Jul 9 13:36:03 2001 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.c,v 1.357 2001/07/09 10:20:40 thies Exp $ */ +/* $Id: basic_functions.c,v 1.358 2001/07/09 17:36:03 rasmus Exp $ */ #include "php.h" #include "php_main.h" @@ -268,6 +268,7 @@ #endif PHP_FE(getmyuid, NULL) + PHP_FE(getmygid, NULL) PHP_FE(getmypid, NULL) PHP_FE(getmyinode, NULL) PHP_FE(getlastmod, NULL) @@ -846,6 +847,7 @@ BG(mmap_file) = NULL; #endif BG(page_uid) = -1; + BG(page_gid) = -1; BG(page_inode) = -1; BG(page_mtime) = -1; #ifdef HAVE_PUTENV Index: php4/ext/standard/basic_functions.h diff -u php4/ext/standard/basic_functions.h:1.80 php4/ext/standard/basic_functions.h:1.81 --- php4/ext/standard/basic_functions.h:1.80 Tue May 22 15:19:04 2001 +++ php4/ext/standard/basic_functions.h Mon Jul 9 13:36:04 2001 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.h,v 1.80 2001/05/22 19:19:04 andi Exp $ */ +/* $Id: basic_functions.h,v 1.81 2001/07/09 17:36:04 rasmus Exp $ */ #ifndef BASIC_FUNCTIONS_H #define BASIC_FUNCTIONS_H @@ -155,6 +155,7 @@ /* pageinfo.c */ long page_uid; + long page_gid; long page_inode; long page_mtime; Index: php4/ext/standard/pageinfo.c diff -u php4/ext/standard/pageinfo.c:1.23 php4/ext/standard/pageinfo.c:1.24 --- php4/ext/standard/pageinfo.c:1.23 Wed Jun 6 09:05:51 2001 +++ php4/ext/standard/pageinfo.c Mon Jul 9 13:36:04 2001 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pageinfo.c,v 1.23 2001/06/06 13:05:51 rasmus Exp $ */ +/* $Id: pageinfo.c,v 1.24 2001/07/09 17:36:04 rasmus Exp $ */ #include "php.h" #include "pageinfo.h" @@ -49,9 +49,10 @@ pstat = sapi_get_stat(); - if (BG(page_uid)==-1) { + if (BG(page_uid)==-1 || BG(page_gid)==-1) { if(pstat) { BG(page_uid) = pstat->st_uid; + BG(page_gid) = pstat->st_gid; BG(page_inode) = pstat->st_ino; BG(page_mtime) = pstat->st_mtime; } @@ -70,6 +71,14 @@ } /* }}} */ +long php_getgid(void) +{ + BLS_FETCH(); + + php_statpage(BLS_C); + return (BG(page_gid)); +} + /* {{{ proto int getmyuid(void) Get PHP script owner's UID */ PHP_FUNCTION(getmyuid) @@ -81,6 +90,21 @@ RETURN_FALSE; } else { RETURN_LONG(uid); + } +} +/* }}} */ + +/* {{{ proto int getmygid(void) + Get PHP script owner's GID */ +PHP_FUNCTION(getmygid) +{ + long gid; + + gid = php_getgid(); + if (gid < 0) { + RETURN_FALSE; + } else { + RETURN_LONG(gid); } } /* }}} */ Index: php4/ext/standard/pageinfo.h diff -u php4/ext/standard/pageinfo.h:1.6 php4/ext/standard/pageinfo.h:1.7 --- php4/ext/standard/pageinfo.h:1.6 Mon Feb 26 01:07:23 2001 +++ php4/ext/standard/pageinfo.h Mon Jul 9 13:36:04 2001 @@ -16,16 +16,18 @@ +----------------------------------------------------------------------+ */ -/* $Id: pageinfo.h,v 1.6 2001/02/26 06:07:23 andi Exp $ */ +/* $Id: pageinfo.h,v 1.7 2001/07/09 17:36:04 rasmus Exp $ */ #ifndef PAGEINFO_H #define PAGEINFO_H PHP_FUNCTION(getmyuid); +PHP_FUNCTION(getmygid); PHP_FUNCTION(getmypid); PHP_FUNCTION(getmyinode); PHP_FUNCTION(getlastmod); extern long php_getuid(void); +extern long php_getgid(void); #endif Index: php4/main/main.c diff -u php4/main/main.c:1.371 php4/main/main.c:1.372 --- php4/main/main.c:1.371 Mon Jul 2 14:17:09 2001 +++ php4/main/main.c Mon Jul 9 13:36:04 2001 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: main.c,v 1.371 2001/07/02 18:17:09 zeev Exp $ */ +/* $Id: main.c,v 1.372 2001/07/09 17:36:04 rasmus Exp $ */ /* {{{ includes */ @@ -213,6 +213,7 @@ STD_PHP_INI_BOOLEAN("register_argc_argv", "1", PHP_INI_ALL, OnUpdateBool, register_argc_argv, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("register_globals", "1", PHP_INI_ALL, OnUpdateBool, register_globals, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode, php_core_globals, core_globals) + STD_PHP_INI_BOOLEAN("safe_mode_gid", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode_gid, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("short_open_tag",DEFAULT_SHORT_OPEN_TAG, PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateBool, short_tags, zend_compiler_globals, compiler_globals) STD_PHP_INI_BOOLEAN("sql.safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, sql_safe_mode, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("track_errors", "0", PHP_INI_ALL, OnUpdateBool, track_errors, php_core_globals, core_globals) Index: php4/main/php_globals.h diff -u php4/main/php_globals.h:1.63 php4/main/php_globals.h:1.64 --- php4/main/php_globals.h:1.63 Wed Apr 4 16:46:26 2001 +++ php4/main/php_globals.h Mon Jul 9 13:36:04 2001 @@ -68,6 +68,7 @@ zend_bool implicit_flush; zend_bool safe_mode; + zend_bool safe_mode_gid; zend_bool sql_safe_mode; zend_bool enable_dl; Index: php4/main/safe_mode.c diff -u php4/main/safe_mode.c:1.30 php4/main/safe_mode.c:1.31 --- php4/main/safe_mode.c:1.30 Wed Jun 6 09:05:53 2001 +++ php4/main/safe_mode.c Mon Jul 9 13:36:04 2001 @@ -15,7 +15,7 @@ | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: safe_mode.c,v 1.30 2001/06/06 13:05:53 rasmus Exp $ */ +/* $Id: safe_mode.c,v 1.31 2001/07/09 17:36:04 rasmus Exp $ */ #include "php.h" @@ -29,6 +29,7 @@ #include "ext/standard/pageinfo.h" #include "safe_mode.h" #include "SAPI.h" +#include "php_globals.h" /* @@ -46,7 +47,7 @@ { struct stat sb; int ret; - long uid=0L, duid=0L; + long uid=0L, gid=0L, duid=0L, dgid=0L; char *s; if (!filename) { @@ -120,6 +121,8 @@ } if (duid == (uid=php_getuid())) { return 1; + } else if (PG(safe_mode_gid) && dgid == (gid=php_getgid())) { + return 1; } else { SLS_FETCH(); @@ -129,7 +132,11 @@ } } - php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid); + if (PG(safe_mode_gid)) { + php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid/gid is %ld/%ld is not allowed to access %s owned by uid/gid %ld/%ld", uid, gid, filename, duid, dgid); + } else { + php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid); + } return 0; } }