Running CGIs under my uid - going slowly insane.

[Oleg Broytmann]

On Fri, Feb 01, 2002 at 06:09:43PM +0000, Donn Cave wrote:
> ...
> | Note that setting an executable's setuid bit will change the "effective" uid
> | of the resulting process, not the uid (see 'os.get*e*uid()' above). This
> | means that the process may use that user's permissions.
> 
> That's true, but "executable" in this context usually means the binary,
> i.e., python itself.  Years ago, some UNIX platforms introduced a hack
> that made setuid effective for script files, but today that is universally
> recognized to have been misguided.  That's why I'm curious about yours.

   Solaris has special mesures that allow setuid scripts to be more secure.

> Perl is subject to the same limitation, but has optional support for
> setuid.  How can that be?  I'm no Perl whiz, but I assume you install
> perl itself setuid root, and then it checks its input file for setuid
> and either sets its ID accordingly or reverts to the invoker's ID.

   This is standard Perl installation - Perl has perl binary and taintperl
setuid binary.

> This option is not the default and is rather discouraged as I recall it.

   In Perl taintperl considered quite secure, much more secure than any
setuid security mesures.

Oleg.
-- 
     Oleg Broytmann            http://phd.pp.ru/            phd at phd.pp.ru
           Programmers don't die, they just GOSUB without RETURN.