Sample Header Ad - 728x90

Can Apache 2.4 run setuid root CGI binaries?

0 votes
1 answer
77 views
Note that I'm not asking about suEXEC, because the binary must be setuid root, and suEXEC doesn't allow root to execute CGI programs. I need to carry out a one-time configuration during system installation, via Apache. To do this, the client POSTs a request to a setuid root binary (compiled C++, owned by root:root, mode u+s). This almost works: the script does run as root, and modifies system files as required. However, it does *not* return stdout to Apache, so Apache thinks that it dies without producing any headers. Apache's error log contains nothing useful (just the usual 'no headers' message), and the CGI log/debug file also contains nothing useful (it just gives an empty %response, with nothing shown for %stdout or %stderr). I've tested the binary by running it on the server from a script which supplies the required POST data on stdin, and records stdout and stderr. It also runs it under valgrind. However, valgrind can't (easily) run setuid binaries, so I revert the binary to a plain 755 mode, and run the test script as root. In these conditions, the binary performs exactly as expected: valgrind reports no errors, stdout is a valid HTML response with status 200, and stderr contains only the valgrind output. Any insight appreciated.
Asked by QF0 (391 rep)
Jul 20, 2024, 05:38 PM
Last activity: Jul 21, 2024, 11:39 AM