Re: shebang through suid-wrapper (execv)

Johan, Your problem has to do with the combination of your suexec-like cgi-wrapper and the detection algorythem implied in php. CGI mode of php detects your webserver by looking at various environment rules (eg. SERVER_SOFTWARE). When you a cgi is executed by the webserver (ex. wrapper.cgi), PATH_TRANSLATED and/or SCRIPT_FILENAME is set by the webserver to point to the script you just executed, which is wrapper.cgi. PHP sees this and then decides to execute wrapper.cgi. All you need to do to fix your problem is set PATH_TRANSLATED to the name of the script you want to run. In answer to your question about mailing me directly, I do not mind, but I ask that you cc the php-dev list in case I'm not around. Here is the corrected wrapper.c: #include <stdlib.h> main(argc,argv) int argc; char **argv; { char file[] = "./test.cgi"; putenv("PATH_TRANSLATED=./test.cgi"); execv(file, argv); } -Jason ----- Original Message ----- From: "Johan Ekenberg" <johan@ekenberg.se> To: <jason@php.net> Sent: Friday, January 19, 2001 9:36 AM Subject: shebang through suid-wrapper (execv) > Hi! > > I saw your name in a few of the bug-reports at bugs.php.net concerning > shebang related problems. I have a problem which I'm not sure if I should > report as a bug or not: > > I'm trying to use a C-wrapper for PHP just like I do for cgi scripts written > in Perl. The reason is to run the script suid user. I made a small cgi > script in C, which uses execv() to start the actual program - a Perl or PHP > script. This works perfectly when the actual program is a Perl script, but > when it's a PHP script the PHP binary tries to parse and execute the calling > program (the wrapper) instead of the called file. > > The VERY STRANGE thing is that it works when I execute the wrapper at the > commandline, but when the wrapper is called by Apache as a cgi, then PHP > outputs the contents of the compiled wrapper (lots of garbage) instead of > executing the PHP script. Somewhere along the line I guess that PHP gets > "/usr/bin/php wrapper.c" instead of "/usr/bin/php wrapped-php.cgi". Forget > the suid stuff, it doesn't matter if I add or remove the suid-bit on the > wrapper binary. > > I'm not sure if I'm explaining myself. Please tell me if I should take this > to someone else, or to a mailinglist (which one?). > > An example here: > http://www.ekenberg.se/phpwrap/ > > The files: > > == wrapper.c == (gcc -o wrapper.cgi wrapper.c) > main(argc,argv) > int argc; > char **argv; > { > char file[] = "/path/to/wrapped-php.cgi"; > execv(file, argv); > } > // EOF > > == wrapped-php.cgi == > #!/usr/bin/php > <?php > echo "this is a test\n"; > ?> > // EOF > > > Best regards, > /Johan Ekenberg > >