On the www.wsu.edu web server we are
using the Apache software. This software has a new
feature which requires CGI programs to run under the user
ID of the owner of the program. This feature reduces
considerably the insecurity of allowing users to run CGI
programs. Following is a list of requirements imposed by
the Apache software.
- All scripts are run under the
actual owner of the script. You can view the
owner of the script by saying:
% ls -l sample.cgi
-rwxr-xr-x 1 joe guest 10 Feb 28 12:14
sample.cgi |
In this example,
the file sample.cgi will be run with all of the
permissions of the user named "joe".
Anything that user "joe" can do, that
script can also do. Likewise, anything that
"joe" cannot do, this script also
cannot do.
- You may not execute a command in
the cgi script that begins with "/"
- The current working directory for
the cgi script must be an actual directory
- The current working directory must
not be writable by group nor world. If you
list the file and the permissions are like:
% ls -l lister.cgi
-rwxr-xrwx 1 joe guest 10 Feb 28 12:14
lister.cgi |
Then this file will not run,
because the world permission is writable. Some
people made files and directories world writable
to be able to use them with the older apache
server software. You would need to change the
permission on this file to omit write. You would
do this by saying:
% chmod 755
lister.cgi
% ls -l lister.cgi
-rwxr-xr-x 1 joe guest 10 Feb 28 12:14
lister.cgi |
- Neither the cgi script nor system
command inside may be symbolic links. You can
determine if a file is a symbolic link by saying:
% ls -l
symbolic_linked.cgi
lrwxr-xr-x 1 joe guest 10 Feb 28 12:14
symbolic_linked.cgi |
- Programs being executed may not be
setuid or setgid.
- The user and group names owning
the file must really exist.
- A script or program that runs,
will only run if the owner of the script is the
same as the owner of the directory it resides in.
|
