So instead of the 'su' trick we could try to traverse the path and check each directory whether it's rwx by user/group Apache is run with.

It's not enough to check that the dir is rwx by user or all, but need to check also whether 'nobody' is in the group which is rwx. As we may have:

drwx------ nobody   whatever /foo # explicit group match
drwxrwx--- whatever nobody   /foo # explicit group match
drwxrwx--- whatever web      /foo # is nobody in the group 'web'
drwxrwxrwx whatever whatever /foo # always good

Also we may have to deal with .acl filesystems supporting .acl where the above logic won't apply. Therefore I came up with a very trivial test not relying on any external apps (and hopefully this time portable) and filesystem perms specs:

perl -e 'require POSIX; POSIX::setuid(65534); POSIX::setgid(65534); \
         print -r q{/tmp} &&  -w _ && -x _ ? q{OK} : q{NOK}; '

Please let me know if you have any problems with it. I've committed this solution, so you can try with the current cvs.

__________________________________________________________________
Stas Bekman            JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/     mod_perl Guide ---> http://perl.apache.org
mailto:[EMAIL PROTECTED] http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org   http://ticketmaster.com



Reply via email to