nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CGI script

amaresh

Hi All,

Thanks in advance. I am trying to run a CGI program. When I execute the CGI program, it should always run as root. Could any one tell me,what should I include in my CGI program.

TeamSite 6.5
UNIX

Thanks,
Shetty

Find more posts tagged with

Comments

Migrateduser

You should set a UID bit on the script itself, assuming it's owned by root. You can set this with:

chmod u+s script.cgi

... for instance. Needless to say, use care when doing this and you might want to make sure that this script is NOT world-writable (or perhaps even group writable). There are some serious security implications to doing this but that's how to do it.

ISCBorisB

You should set a UID bit on the script itself, assuming it's owned by root. You can set this with:

chmod u+s script.cgi

... for instance. Needless to say, use care when doing this and you might want to make sure that this script is NOT world-writable (or perhaps even group writable). There are some serious security implications to doing this but that's how to do it.

I *think* it should also be invoked without CGI wrapper in any of it's incarnations

nipper

Hi All,

Thanks in advance. I am trying to run a CGI program. When I execute the CGI program, it should always run as root. Could any one tell me,what should I include in my CGI program.

TeamSite 6.5
UNIX

Thanks,
Shetty

What type of app ? If this is a perl cgi, then you will need to put perl into taint mode (perl -T) when testing.

Taint mode protects the app from being hijacked.

HTH

ANdy

amaresh

Hi,

Thanks for the response. I am trying to set the permission ie, code it inside the CGI program itself. So that only all the Teamsite users can run the script as root and not any other users of the UNIX machine. Is there a CTL, which can achieve this functionality. Andy, it is a perl CGI.

Thanks.

nipper

No out of the box funxtionality but it is not too tough to do what you want. You need to, in the CGI, determine who is running the CGI and whether they should be able to. You may want to do that with an htaccess (for Apache). Have the CGI set to run as root, with the setuid bit. Note, reseach taint mode in Perl, when a perl script runs as root, it runs with restrictions. Know those and test with the -T flag.

Andy

amaresh

Andy,

Thanks for your idea. htaccess is fine. But how to set the Setuid bit. Could you please elaborate on this.

Thanks!!

Migrateduser

I actually answered this previously in this thread:

chmod u+s <filename>

amaresh

Dave,

Thanks for your reply. I know that we can change the permissions using chmod. But my requirement is in such a way that I have to run the CGI script as root on execution. We do not want to set the permission bit before the script is executed. We would like to code inside the CGI script at the beginning so that it runs as root.

Thanks.

Adam Stoller

Dave,

Thanks for your reply. I know that we can change the permissions using chmod. But my requirement is in such a way that I have to run the CGI script as root on execution. We do not want to set the permission bit before the script is executed. We would like to code inside the CGI script at the beginning so that it runs as root.

Thanks.

Please talk to your local system administrator - perhaps they can clarify what Dave & Andy have been trying to get through to you. To begin with - they probably won't let you create a setuid root perl script - so the entire issue may be moot. If they are willing to let you create a setuid root perl script - they can explain to you how it gets setup, what limitations there are, etc. TeamSite does NOT provide any functionality to help you with creating setuid root CGI scripts.

Migrateduser

I'm not sure that I understand, then. Doing the "chmod u+s <filename>" sets the setuid bit and makes it so that anyone executing the script runs it as whomever owns the script. So, if root owns the script and the unix-style permissions look something like the following (important part in blue):

-rwS--x---

But again, use this with exreme caution because this opens up a number of security vulerabilities. Taking the two following steps mitigates *some* of these vulerabilities:

1. Chmod the file to "o-rwx" again so that not just any user on the system can execute this script (or even users not on the system via RPC but that's another topic).
2. To follow #1, make it group executable and create a group of users only for people who should have access to that script.

Depending on how you want to use this, you may prefer to use sudo instead of setuid. This method is somewhat more secure.

nipper

man chmod

RTFM

Migrateduser

Wow... okay, I guess I knew the F would make it into this thread eventually :-)