Privilege separation revisited

2003-07-31 Thread Joel Palmius
This is something I asked before, like one or two years ago. I just want to see if a solution has come up since then. The problem is that with the normal (linux-distro) installation of apache and mod_perl, all processes for all active scripting (cgi, perl, PHP..) run as the same user. Thus, if

[mp1] Safe segfaults with mp1

2003-07-24 Thread Joel Palmius
This works, separate file /tmp/test.pl: use Safe; my($compartment) = new Safe; $compartment-permit(qw(:browse)); $compartment-reval(print \gnu\n\;); if($@) { die $@; } print \n\n; (Script prints gnu) This does not work, in perl-handler Handler.pm: [...] use Safe;

Re: [mp1] Safe segfaults with mp1

2003-07-24 Thread Joel Palmius
Ah, well, after a five hours of experimentation I thought up a working workaround anyway. This works with an unpatched version of mp1 ($substr is any perl code fetched from external source): my(@ops) = split(/\x0a/,$substr); my($cell,$reval); foreach $cell (@ops) {

Local file security (in 1.27)

2002-08-01 Thread Joel Palmius
I'm developing an online survey system under mod_perl (with a homemade perlhandler, not under Apache::Registry). Since I've had as a goal to avoid as many dependencies as possible, I store results in local plaintext files. By nature, these files has (?) to be writable by the uid apache runs as.

Client capabilities

2002-04-30 Thread Joel Palmius
Is there a mod_perl API (or some other standard way) to determine what a client web browser is capable of displaying? (images, tables, plugins...) I am developing a web questionnaire system in mod_perl (1.26) and I'm thinking about maybe dividing the display code into different levels