Bug #416
lighttpd fails to start for a non-root user with gid 0
| Status: | New | Start: | ||
| Priority: | Normal | Due date: | ||
| Assigned to: | jan | % Done: | 0% |
|
| Category: | core | |||
| Target version: | 1.4.21 | |||
| Pending: | No |
Resolution: | ||
Description
Trying to start lighttpd as a non-root user in the wheel group fails with "Are you nuts ? Don't apply a SUID bit to this binary" despite the binary not being SUID.
The problem seems to be that on line 345 of server.c {{{ i_am_root = (getuid() 0)}} and doesn't take into consideration gid. This means that on line 422 of that same file {{{ (!i_am_root && (geteuid() 0 || getegid() == 0)) }}} is true and it is assumed that we are setuid, when in fact the binary is not and it is simply the case that the user is in wheel group.
-- careo
History
08/14/2008 11:15 AM - Anonymous
Under Solaris and the BSDs, the issetugid(2) system call can be used to check for setuid/setgid binaries.
There's a patch by Robert Connolly from Linux From Scratch written for glibc to add issetugid(2) which could be appropriated here.
See http://www.linuxfromscratch.org/patches/hlfs/svn/glibc-2.5.1-issetugid-1.patch and
http://codewiki.ucc.gu.uwa.edu.au:180/issetugid.c
At the very least, rather than
(!i_am_root && (geteuid() == 0 || getegid() == 0))
lighttpd could use
(!i_am_root && (geteuid() != getuid() || getegid() != getugid() ))
-- zanchey