Re: safe_mode and file upload
| From: | derick@php.net | Date: | Mon, 14 Jan 2002 11:24:45 +0000 |
| Subject: | Re: safe_mode and file upload | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-77001@lists.php.net to get a copy of this message | ||
On Mon, 14 Jan 2002, Hartmut Holzgraefe wrote:
> derick@php.net wrote:
>
> > Yeah, _our_ mod_become swaps between user ids. If the standard mod_become
> > does not do that, than our sysadm coded that. (I'm unclear what he did
> > exactly). But we have it running on our production machine now, without
> > any problems.
>
> could you please explaing how a process is able to change its
> user id at will? afaik only root is allowed to change the user id
> and there is no way back (for a reason)
There is a way though, Linux has the concept of 'saved uids', don't ask me
how it works. A process can swap back to it's safed useruid.
> and if there was a way to do so, how would you prevent a certain
> piece of code to do so while you allow it for another piece of
> code in the same process?
Which piece of code should be prevented to do this then?
Derick