1. Forum
  2. Usenet
  3. COMP.UNIX.SOLARIS

  • Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the c

    From ARZ Lab@21:1/5 to All on Mon Oct 9 08:51:07 2023
    Hi All,
    After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
    In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

    Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Gary R. Schmidt@21:1/5 to ARZ Lab on Fri Oct 13 23:24:11 2023
    On 10/10/2023 02:51, ARZ Lab wrote:
    Hi All,
    After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
    In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

    Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS

    This has me intrigued, what are you doing with the browser and how is
    your web space set up that it can see such things???

    Cheers,
    Gary B-)

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From ARZ Lab@21:1/5 to Gary R. Schmidt on Thu Oct 19 08:08:07 2023
    On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
    On 10/10/2023 02:51, ARZ Lab wrote:
    Hi All,
    After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
    In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

    Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
    This has me intrigued, what are you doing with the browser and how is
    your web space set up that it can see such things???

    Cheers,
    Gary B-)

    Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
    It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
    I made a simple and clean demo, the prod server behaves the same way

    root@inet:/# zoneadm list -iv
    ID NAME STATUS PATH BRAND IP
    3 inet running / solaris shared

    root@inet:/# uname -a
    SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone

    I'm running in NGZ, allright

    From /var/apache2/2.4/conf/httpd.conf:

    User webservd
    DocumentRoot "/var/apache2/2.4/htdocs"

    oot@inet:/# ps -ef | grep http
    webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
    webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
    webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
    webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
    webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
    webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
    webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http


    Now watch my fingers!

    root@inet:/# find /var/apache2/2.4/htdocs -ls
    8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
    8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
    8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
    8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
    8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
    8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
    root@inet:/#
    root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
    haha

    Yeah, root can of course

    root@inet:/#
    root@inet:/# su - webservd
    webservd@inet:~$
    webservd@inet:~$
    webservd@inet:~$ id -a
    uid=80(webservd) gid=80(webservd) groups=80(webservd)
    webservd@inet:~$

    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
    /var/apache2/2.4/htdocs: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
    /var/apache2/2.4/htdocs/a: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
    total 17
    d--------- 3 root root 3 Oct 9 10:49 c

    All as expected so far...

    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt
    /var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied

    And this too. But then...

    webservd@inet:~$
    webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
    haha
    webservd@inet:~$

    What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?

    Pleeease don't tell me I must use Linux ))

    Thanks for reading this, I hope you are having fun, too ))
    It's not a joke, honestly!

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Steffen Moser@21:1/5 to ARZ Lab on Fri Oct 27 01:48:40 2023
    Hi,

    very strange. Cannot reproduce it on Solaris 11.4 SRU 62, x86-64,
    non-global zone. Will try on SRU 42. What I find strange at a first
    glance is that you seem to have Apache's config file sitting in

    /var/apache2/2.4/conf/httpd.conf

    on a "simple and clean demo". AFAIK, the default place of Apache 2.4's
    config on Solaris 11.4 should be

    /etc/apache2/2.4/...

    I don't have a "conf" subdirectory in "/var/apache/2.4" at all.

    Maybe "truss" gives you some more insight how Apache is capable to
    access the directory and the document within the structure?

    Kind regards,
    Steffen



    On 19.10.23 17:08, ARZ Lab wrote:
    On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
    On 10/10/2023 02:51, ARZ Lab wrote:
    Hi All,
    After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
    In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

    Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
    This has me intrigued, what are you doing with the browser and how is
    your web space set up that it can see such things???

    Cheers,
    Gary B-)

    Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
    It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
    I made a simple and clean demo, the prod server behaves the same way

    root@inet:/# zoneadm list -iv
    ID NAME STATUS PATH BRAND IP
    3 inet running / solaris shared

    root@inet:/# uname -a
    SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone

    I'm running in NGZ, allright

    From /var/apache2/2.4/conf/httpd.conf:

    User webservd
    DocumentRoot "/var/apache2/2.4/htdocs"

    oot@inet:/# ps -ef | grep http
    webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
    webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
    webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
    webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
    webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
    webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
    webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http


    Now watch my fingers!

    root@inet:/# find /var/apache2/2.4/htdocs -ls
    8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
    8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
    8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
    8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
    8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
    8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
    root@inet:/#
    root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
    haha

    Yeah, root can of course

    root@inet:/#
    root@inet:/# su - webservd
    webservd@inet:~$
    webservd@inet:~$
    webservd@inet:~$ id -a
    uid=80(webservd) gid=80(webservd) groups=80(webservd)
    webservd@inet:~$
    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
    /var/apache2/2.4/htdocs: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
    /var/apache2/2.4/htdocs/a: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
    total 17
    d--------- 3 root root 3 Oct 9 10:49 c

    All as expected so far...

    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt /var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied

    And this too. But then...

    webservd@inet:~$
    webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
    haha
    webservd@inet:~$

    What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?

    Pleeease don't tell me I must use Linux ))

    Thanks for reading this, I hope you are having fun, too ))
    It's not a joke, honestly!

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From John D Groenveld@21:1/5 to usenet@steffen-moser.de on Fri Oct 27 12:37:23 2023
    In article <uhetso$o7gi$1@solani.org>,
    Steffen Moser <usenet@steffen-moser.de> wrote:
    very strange. Cannot reproduce it on Solaris 11.4 SRU 62, x86-64,
    non-global zone. Will try on SRU 42. What I find strange at a first
    glance is that you seem to have Apache's config file sitting in

    /var/apache2/2.4/conf/httpd.conf

    on a "simple and clean demo". AFAIK, the default place of Apache 2.4's
    config on Solaris 11.4 should be

    /etc/apache2/2.4/...

    I don't have a "conf" subdirectory in "/var/apache/2.4" at all.

    The manifest for pkg://solaris/web/server/apache-24 is here: <URL:http://pkg.oracle.com/solaris/release/manifest/0/web%2Fserver%2Fapache-24@2.4.51%2C11.4-11.4.42.0.0.111.0%3A20211203T212052Z>

    Best practice is possibly to drop your customizations into a single application.conf in /etc/apache2/2.4/conf.d which automagically gets
    included

    John
    groenveld@acm.org

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Steffen Moser@21:1/5 to ARZ Lab on Wed Nov 1 14:27:34 2023
    Hi again,

    tried to reproduce it on Solaris 11.4.42.111.0, but cannot:

    curl http://localhost/a/b/c/d/e.txt

    gives me Apache's permission denied output - as expected.

    The only difference is the position of the httpd.conf file. In a plain installation of Solaris 11.4 CBE, I don't find a

    /var/apache2/2.4/conf/

    directory.

    Kind regards,
    Steffen

    On 19.10.23 17:08, ARZ Lab wrote:
    On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
    On 10/10/2023 02:51, ARZ Lab wrote:
    Hi All,
    After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
    In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

    Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
    This has me intrigued, what are you doing with the browser and how is
    your web space set up that it can see such things???

    Cheers,
    Gary B-)

    Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
    It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
    I made a simple and clean demo, the prod server behaves the same way

    root@inet:/# zoneadm list -iv
    ID NAME STATUS PATH BRAND IP
    3 inet running / solaris shared

    root@inet:/# uname -a
    SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone

    I'm running in NGZ, allright

    From /var/apache2/2.4/conf/httpd.conf:

    User webservd
    DocumentRoot "/var/apache2/2.4/htdocs"

    oot@inet:/# ps -ef | grep http
    webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
    webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
    webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
    webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
    webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
    webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
    webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http


    Now watch my fingers!

    root@inet:/# find /var/apache2/2.4/htdocs -ls
    8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
    8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
    8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
    8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
    8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
    8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
    root@inet:/#
    root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
    haha

    Yeah, root can of course

    root@inet:/#
    root@inet:/# su - webservd
    webservd@inet:~$
    webservd@inet:~$
    webservd@inet:~$ id -a
    uid=80(webservd) gid=80(webservd) groups=80(webservd)
    webservd@inet:~$
    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
    /var/apache2/2.4/htdocs: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
    /var/apache2/2.4/htdocs/a: Permission denied
    total 17
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
    total 17
    d--------- 3 root root 3 Oct 9 10:49 c

    All as expected so far...

    webservd@inet:~$
    webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt /var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied

    And this too. But then...

    webservd@inet:~$
    webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
    haha
    webservd@inet:~$

    What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?

    Pleeease don't tell me I must use Linux ))

    Thanks for reading this, I hope you are having fun, too ))
    It's not a joke, honestly!

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)