Thread: Using system call + wrapper?
Hi
I am trying to allow people to save images from their file system to a
directory on my machine called images, for example the path that I want to
save to is /usr/local/apache/htdocs/project/images/.
Obviously from above I am using an Apache web server, PHP and PostgreSQL.
My problem is that you need sudo access to save anything to this
directory so I get a "Permission denied..." error on the browser. I want
to save the image to the images directory and save the path to a table in
my database, however I can do neither in the current situation.
It was suggested to me to use a wrapper that invokes a system call such as
system('sudo upload.php -p password') that will run the program in sudo
but I really don't know where to start with this??
Can anyone please help me?
=========================================================
Richie Duggan
Computer Science IV
University College Cork
Eamil : dugganr@student.cs.ucc.ie richie_dug@yahoo.com
Homepage : http://student.cs.ucc.ie/01/dugganr/index.html
On Mon, 26 Feb 2001, Richie wrote: -> /usr/local/apache/htdocs/project/images/. -> ->My problem is that you need sudo access to save anything to this ->directory 'chown <HTTP USER> /usr/local/apache/htdocs/project/images/' 'chmod 755 /usr/local/apache/htdocs/project/images/' That should take care of the problem, shouldn't it? -- Dave
On Mon, 26 Feb 2001, Richie wrote:
> It was suggested to me to use a wrapper that invokes a system call such as
> system('sudo upload.php -p password') that will run the program in sudo
> but I really don't know where to start with this??
You should never, ever, ever run CGI-/PHP-applications as root. And
running things as root is what sudo normally does. Is that what you're
contemplating?
If so, alter the owner of the directory instead so that your ordinary
CGI-/PHP-scripts may write to it. But be _very_ careful how you write your
code. Can anybody upload things? What happens when the filesystem gets
full? Also be very careful that you do not trust any data the user
supplies, especially not with the "system" call.
/Viktor...
--| Viktor Fougstedt, system administrator at dtek.chalmers.se |--
--| http://www.dtek.chalmers.se/~viktor/ |--
--| ...soon we'll be sliding down the razor blade of life. /Tom Lehrer |--
> I am trying to allow people to save images from their file system to a
> directory on my machine called images, for example the path that I want to
> save to is /usr/local/apache/htdocs/project/images/.
>
> Obviously from above I am using an Apache web server, PHP and PostgreSQL.
> My problem is that you need sudo access to save anything to this
> directory so I get a "Permission denied..." error on the browser. I want
> to save the image to the images directory and save the path to a table in
> my database, however I can do neither in the current situation.
>
> It was suggested to me to use a wrapper that invokes a system call such as
> system('sudo upload.php -p password') that will run the program in sudo
> but I really don't know where to start with this??
The easiest thing to do is allow the web server write access to the upload
directory or perhaps some creative use of sym links would work.. This one is
a little out there but you could also save the files in a temporary
directory and have a cron job every minute or so go through and copy
everything in that directory over to the one you need the files in. If
you're using PHP as an apache module then I don't think you can run a single
script as a different user, though you might want to check on apache's
su-exec functionality for CGI scripts.. If you're running a CGI you could
always use the ever-so-insecure suid bit solution but I would suggest
against it..
Good luck!
-Mitch
Any reason you don't have the images uploaded to somewhere that you don't have such security issues? Like a home directory or something? Adam Lang Systems Engineer Rutgers Casualty Insurance Company http://www.rutgersinsurance.com ----- Original Message ----- From: "Richie" <dugganr@student.cs.ucc.ie> To: <pgsql-php@postgresql.org> Sent: Monday, February 26, 2001 12:01 PM Subject: [PHP] Using system call + wrapper? > Hi > > I am trying to allow people to save images from their file system to a > directory on my machine called images, for example the path that I want to > save to is /usr/local/apache/htdocs/project/images/. > > Obviously from above I am using an Apache web server, PHP and PostgreSQL. > My problem is that you need sudo access to save anything to this > directory so I get a "Permission denied..." error on the browser. I want > to save the image to the images directory and save the path to a table in > my database, however I can do neither in the current situation. > > It was suggested to me to use a wrapper that invokes a system call such as > system('sudo upload.php -p password') that will run the program in sudo > but I really don't know where to start with this?? > > Can anyone please help me? > > ========================================================= > Richie Duggan > Computer Science IV > University College Cork > Eamil : dugganr@student.cs.ucc.ie richie_dug@yahoo.com > Homepage : http://student.cs.ucc.ie/01/dugganr/index.html
: On Mon, 26 Feb 2001, Richie wrote: : : -> /usr/local/apache/htdocs/project/images/. : -> : ->My problem is that you need sudo access to save anything to this : ->directory : : 'chown <HTTP USER> /usr/local/apache/htdocs/project/images/' : 'chmod 755 /usr/local/apache/htdocs/project/images/' : : That should take care of the problem, shouldn't it? : : -- Dave That would take care of it, but then you just blocked any normal FTP access into that directory. I would: 'chgrp [HTTPD USER] /usr/local/apache/htdocs/project/images' 'chmod g+w /usr/local/apache/htdocs/project/images' That way, the current user still has control, but the HTTPD user also has write access. -Dan
I think you've got a lot of good suggestions on how to tackle this
specific issue. One thing regarding overall design that was briefly
touched on... You might want to consider having uploading be put into a
staging area that makes no assumptions regarding content, then have a
cron job transfer data over to your productive environment (or
productive directory)... (this was suggested by one of the posts, but
I'm just elaborating on it a bit). This cron job will add a layer of
abstraction that will provide you with a good bit of flexibility if your
app grows or needs to change at all. The cron job can then be easily
modified to do certain checks: is the file valid? Is it in some way
unreasonable? Is there space for it in the productive area? Does the
file already exist? If so, should it be overwritte? If I were building
this app, I'd make special effort to seperate content into at least two
camps in the production environment: content you've written, that's
verified, and content that's in
some way dependant on the user uploading or whatever. Generally, try to
keep these two as seperate as possible -- even a new directory tree
using symbolic links would be good -- make a /home/usersubmissions or
something to keep this second type of content in, then your /apache tree
is a lot cleaner. Also, putting your usersubmissions on another
partition (if you've got /usr/local on its own) will prevent /usr/local,
or on Red Hat /var/www from running out of space... if /home runs out of
space, not as big a deal than if some other directories do.
Steve
On Mon, 26
Feb 2001, Richie wrote:
> Hi
>
> I am trying to allow people to save images from their file system to a
> directory on my machine called images, for example the path that I want to
> save to is /usr/local/apache/htdocs/project/images/.
>
> Obviously from above I am using an Apache web server, PHP and PostgreSQL.
> My problem is that you need sudo access to save anything to this
> directory so I get a "Permission denied..." error on the browser. I want
> to save the image to the images directory and save the path to a table in
> my database, however I can do neither in the current situation.
>
> It was suggested to me to use a wrapper that invokes a system call such as
> system('sudo upload.php -p password') that will run the program in sudo
> but I really don't know where to start with this??
>
> Can anyone please help me?
>
> =========================================================
> Richie Duggan
> Computer Science IV
> University College Cork
> Eamil : dugganr@student.cs.ucc.ie richie_dug@yahoo.com
> Homepage : http://student.cs.ucc.ie/01/dugganr/index.html
>
On Mon, 26 Feb 2001, Richie wrote: -> /usr/local/apache/htdocs/project/images/. -> ->My problem is that you need sudo access to save anything to this ->directory 'chown <HTTP USER> /usr/local/apache/htdocs/project/images/' 'chmod 755 /usr/local/apache/htdocs/project/images/' That should take care of the problem, shouldn't it? -- Dave
I think you've got a lot of good suggestions on how to tackle this
specific issue. One thing regarding overall design that was briefly
touched on... You might want to consider having uploading be put into a
staging area that makes no assumptions regarding content, then have a
cron job transfer data over to your productive environment (or
productive directory)... (this was suggested by one of the posts, but
I'm just elaborating on it a bit). This cron job will add a layer of
abstraction that will provide you with a good bit of flexibility if your
app grows or needs to change at all. The cron job can then be easily
modified to do certain checks: is the file valid? Is it in some way
unreasonable? Is there space for it in the productive area? Does the
file already exist? If so, should it be overwritte? If I were building
this app, I'd make special effort to seperate content into at least two
camps in the production environment: content you've written, that's
verified, and content that's in
some way dependant on the user uploading or whatever. Generally, try to
keep these two as seperate as possible -- even a new directory tree
using symbolic links would be good -- make a /home/usersubmissions or
something to keep this second type of content in, then your /apache tree
is a lot cleaner. Also, putting your usersubmissions on another
partition (if you've got /usr/local on its own) will prevent /usr/local,
or on Red Hat /var/www from running out of space... if /home runs out of
space, not as big a deal than if some other directories do.
Steve
On Mon, 26
Feb 2001, Richie wrote:
> Hi
>
> I am trying to allow people to save images from their file system to a
> directory on my machine called images, for example the path that I want to
> save to is /usr/local/apache/htdocs/project/images/.
>
> Obviously from above I am using an Apache web server, PHP and PostgreSQL.
> My problem is that you need sudo access to save anything to this
> directory so I get a "Permission denied..." error on the browser. I want
> to save the image to the images directory and save the path to a table in
> my database, however I can do neither in the current situation.
>
> It was suggested to me to use a wrapper that invokes a system call such as
> system('sudo upload.php -p password') that will run the program in sudo
> but I really don't know where to start with this??
>
> Can anyone please help me?
>
> =========================================================
> Richie Duggan
> Computer Science IV
> University College Cork
> Eamil : dugganr@student.cs.ucc.ie richie_dug@yahoo.com
> Homepage : http://student.cs.ucc.ie/01/dugganr/index.html
>