Note that I'm not asking about suEXEC, because the binary must be setuid root, and suEXEC doesn't allow root to execute CGI programs.
I need to carry out a one-time configuration during system installation, via Apache. To do this, the client POSTs a request to a setuid root binary (compiled C++, owned by root:root, mode u+s). This almost works: the script does run as root, and modifies system files as required. However, it does *not* return
stdout
to Apache, so Apache thinks that it dies without producing any headers. Apache's error log contains nothing useful (just the usual 'no headers' message), and the CGI log/debug file also contains nothing useful (it just gives an empty %response
, with nothing shown for %stdout
or %stderr
).
I've tested the binary by running it on the server from a script which supplies the required POST data on stdin, and records stdout and stderr. It also runs it under valgrind
. However, valgrind can't (easily) run setuid binaries, so I revert the binary to a plain 755 mode, and run the test script as root. In these conditions, the binary performs exactly as expected: valgrind reports no errors, stdout
is a valid HTML response with status 200, and stderr
contains only the valgrind output.
Any insight appreciated.
Asked by QF0
(391 rep)
Jul 20, 2024, 05:38 PM
Last activity: Jul 21, 2024, 11:39 AM
Last activity: Jul 21, 2024, 11:39 AM