0

I'm running a PHP process from root which calls posix_setuid(1500); and then tries to open a file output.log

The ls -l output.log shows this output:

-rwxrwxr-x 1 www-data www-data 2294376 Mar 19 12:05 output.log

The id command from my user account(jonny) shows this output:

uid=1500(jonny) gid=1500(jonny) groups=1500(jonny),27(sudo),33(www-data)

Even after changing the uid to jonny why is PHP process not able to write to output.log file?

1

posix_setuid(1500) only changes the UID to 1500. That does not give you permission to access the file. The reason you can access the file when logged in as your regular user is that you not only have UID 1500 but also group 1500 and supplementary groups 27 and 33. Having supplementary group 33 (www-data) is the thing that causes you to have access to the file.

You should probably be doing this:

posix_initgroups("jonny", 1500);
posix_setuid(1500);

The order is important: after you give up root permission by calling posix_setuid you can't set your credentials anymore, so it wouldn't work in the other order.

Note that the documentation for posix_initgroups is probably wrong (like many things in the PHP world). It says it "Calculates the group access list" but I guess that it actually behaves like the POSIX function that it references, which, if true, would mean it doesn't just calculate it but actually sets it.

  • Thanks but will the 2nd arg in posix_initgroups be 1500(jonny) or 33(www-data)? – user5858 Mar 19 '15 at 7:03
  • 1500 (jonny) since that's your primary group. initgroups expects the caller to have already looked up the primary group in advance, because of the typical case that getpwnam or similar was called first and already has access to that information. Note the name of the argument in the function prototype confirms this: it's $base_group_id. – Celada Mar 19 '15 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.