[rt-users] Insecure dependency with FastCGI

[Bob Goldstein]

 No, what happens is that apache is running as one gid,
 but the fastcgi script is setgid to another.  This forces
 perl to turn on taint checking, and the fastsci script
 is not taint-safe.  This would happen with any
 version of perl.

 The simplest solution, if it doesn't break anything else,
 is to change the gid of apache or fastcgi to match.

 Another solution is to start the fastcgi server by hand,
 rather than have apache start it.  Apache still talks
 to it over a socket in any case.  But if you start the
 fastcgi by hand, using the uid/gid of the script itself,
 then perl doesn't force taint checking.

    bobg



>Hanno et. al:
>
>I'm having the same problem on a Solaris 9 box... It would seem to me that
>it's a symptom of rolling our own Perl 5.8.2.
>
>-- 
>Eric Fesh
>Customer Support Engineer/Software Test Engineer
>MPI Software Technology Inc.
>http://www.mpi-softtech.com
>
>
>The information contained in this communication may be confidential and is
>intended only for the use of the recipient(s) named above.  If the reader of
>this communication is not the intended recipient(s), you are hereby notified
>that any dissemination, distribution, or copying of this communication, or
>any of its contents, is strictly prohibited.  If you are not a named
>recipient or received this communication by mistake, please notify the sender
>and delete the communication and all copies of it.
>
>On Fri, 14 Nov 2003, Hanno Mueller wrote:
>
>> Hi,
>>
>>
>> I'm trying to install RT on a Debian Stable box. Since Debian doesn't
>> come with Perl 5.8 yet, I compiled my own 5.8.2. It runs Apache 1.3.26
>> with FastCGI.
>>
>>
>> I followed all the installation instructions for RT.
>>
>>
>> In RT 3.0.6, I get
>>
>> For the Homepage:
>>
>> > Error during compilation of /opt/rt/share/html/index.html:
>> > Insecure dependency in require while running setgid at
>> > /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm line 568
>> > context:   	...
>> > code stack:
>> > /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:580
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:317
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:198
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:166
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:265
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:343
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:213
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:207
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:89
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:72
>> > g /opt/rt/bin/mason_handler.fcgi:53
>> > g
>>
>>
>> For the /Admin/ page:
>>
>> > error:   	Insecure dependency in mkdir while running setgid at
>> > /opt/perl/lib/5.8.2/File/Path.pm line 159.
>> > context:
>> > ...
>> > 155:  	unless (-d $parent or $path eq $parent) {
>> > 156:  	push(@created,mkpath($parent, $verbose, $mode));
>> > 157:  	}
>> > 158:  	print "mkdir $path\n" if $verbose;
>> > 159:  	unless (mkdir($path,$mode)) {
>> > 160:  	my $e = $!;
>> > 161:  	# allow for another process to have created it meanwhile
>> > 162:  	croak "mkdir $path: $e" unless -d $path;
>> > 163:  	}
>> > ...
>> > code stack:  	/opt/perl/lib/5.8.2/File/Path.pm:159
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Compiler/ToObject.pm:102
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:309
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:198
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:166
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:265
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:343
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:213
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:207
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:89
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:72
>> > g /opt/rt/bin/mason_handler.fcgi:53
>> > g
>>
>>
>>
>> In RT 3.0.5, I get for the Homepage:
>>
>> > Insecure dependency in mkdir while running setgid at
>> > /opt/perl/lib/5.8.2/File/Path.pm line 159
>> > context: mkdir
>> > code stack:   	 /opt/perl/lib/5.8.2/File/Path.pm:159
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Compiler/ToObject.pm:102
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:309
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:198
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Request.pm:166
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:265
>> > g /opt/perl/lib/site_perl/5.8.2/Class/Container.pm:343
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:213
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/Interp.pm:207
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:89
>> > g /opt/perl/lib/site_perl/5.8.2/HTML/Mason/CGIHandler.pm:72
>> > g /opt/rt/bin/mason_handler.fcgi:53
>> > g
>>
>>
>>
>>
>> I'm a bit stuck and the mailing list doesn't mention this problem for
>> recent versions. Yet, I cannot use RT with mod_perl on this particular
>> server.
>>
>> Any suggestions?
>>
>>
>> Greetings,
>>
>> Hanno
>>
>>
>>
>> _______________________________________________
>> rt-users mailing list
>> rt-users at lists.fsck.com
>> http://lists.fsck.com/mailman/listinfo/rt-users
>>
>> Have you read the FAQ? The RT FAQ Manager lives at http://fsck.com/rtfm
>>
>
>_______________________________________________
>rt-users mailing list
>rt-users at lists.fsck.com
>http://lists.fsck.com/mailman/listinfo/rt-users
>
>Have you read the FAQ? The RT FAQ Manager lives at http://fsck.com/rtfm
>