From owner-freebsd-newbies  Mon Aug 21 21:39: 3 2000
Delivered-To: freebsd-newbies@freebsd.org
Received: from c014.sfo.cp.net (c014-h017.c014.sfo.cp.net [209.228.12.81])
	by hub.freebsd.org (Postfix) with SMTP id 932C737B43F
	for <freebsd-newbies@FreeBSD.ORG>; Mon, 21 Aug 2000 21:38:59 -0700 (PDT)
Received: (cpmta 29385 invoked from network); 21 Aug 2000 21:38:59 -0700
Received: from d8209670.dsl.flashcom.net (HELO cccd.edu) (216.32.150.112)
  by smtp.flashcom.net with SMTP; 21 Aug 2000 21:38:59 -0700
X-Sent: 22 Aug 2000 04:38:59 GMT
Message-ID: <39A20475.56851974@cccd.edu>
Date: Mon, 21 Aug 2000 21:41:25 -0700
From: Greg Work <gregh@cccd.edu>
X-Mailer: Mozilla 4.73 [en] (Win98; U)
X-Accept-Language: en
MIME-Version: 1.0
To: freebsd-newbies@FreeBSD.ORG
Subject: Problem with Set-user-ID-on-execution bit
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-newbies@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

I'm having problem executing perl scripts that have the
set-user-ID-on-execution bit set through Apache and at the command
line.  For example:

When I try and execute a perl script at the command line as root with
the set-user-ID-on-execution bit set,

-rwsr-xr-x   1 root  wheel    718     Aug 21 20:02     checklogin.pl

the script works given three valid inputs, the location of the password
file, a valid username, and a valid password.  When I su to http and
execute the script wth the same three inputs it fails to open the passwd
file and exits at the 11th line,

--cut--
        open (PASSWD, $passwdfile) or exit 1;
--cut--

Why is an executable file that is set to run as the owner, root, unable
to open the master.passwd file?  This works on other machines with
FreeBSD and Linux(using shadow instead of master.passwd) and doesn't
work on this machine.  FreeBSD 2.2.8 w/ Apache 1.3.12 w/ Perl 5.6.0.  Am
I using the set-user-ID-on-execution bit correctly?

Here is the script described above.
--------------------
#!/usr/bin/perl -T

my ($username, $password, $usr, $pswd, $passwdfile);
my $passcorrect = 0; # default to correct, set incorrect when determined

my $line;
chomp($passwdfile = <STDIN>);
chomp($username = <STDIN>);
chomp($password = <STDIN>);

if ( $passwdfile && $username && $password ) {
   open (PASSWD, $passwdfile) or exit 1;
   print ("passwd openned", "\n");                  # added for testing
   while (defined($line = <PASSWD>)) {
      ($usr,$pswd) = (split(/:/, $line))[0,1];
      last if ($usr eq $username); # We've found the user in /etc/passwd

   }
   close (PASSWD);
   if (($usr ne $username) or (crypt($password, $pswd) ne $pswd)) {
      $passcorrect = 1; # User/Pass combo is WRONG!
   }
} else {
   $passcorrect = 1;
}
print ($passcorrect, "\n");                             # added for
testing
exit $passcorrect;
--------------------



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-newbies" in the body of the message