nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CGI wirte permission issue

Kevin_Huang

Hi All,

I call a perl CGI in my DCT to excutes a system command, that will generate a file to one folder in my workarea. But there is permission issue, I set the permission of the folder 777, and I changed the owner of the folder iwui, the CGI just cannot write to the folder. Seems there is a configure file somewhere, will restrict the folers that CGI have write permission. Because I tried to write to one of my colleague's folder(normal folder, not TeamSite's folder), it succeeded. but I tried to write to other normal folder with 777 permission, it failed. Can some one tell me how to handle this? Thank you in advance.

TeamSite 6.7.2
Solaris 10

Kevin

Find more posts tagged with

Comments

Adam Stoller

Without seeing more details of both the source code and the error messages, it's difficult to determine what is happening / why it's happening.

Are you sure you're providing the right kind of path (file system path vs. vpath) and/or a writable path (workarea path vs staging area or edition path)? These may seem like simplistic questions but since you haven't provided real details that's where the questions have to start.

BIRT Report - Forum - Group Height_01.png

nipper

When you are writing to a workarea. you also have to have execute permissions to every folder from /default on down.

If you have sudo access, do this,

sudo su iwui -
cd /default/
cd main
cd branch
cd branch2
cd WORKAREA
cd Content
etc

see where you fail.

Kevin_Huang

Hi nipper,
the iwui have all the "x" permission.

When you are writing to a workarea. you also have to have execute permissions to every folder from /default on down.

If you have sudo access, do this,

sudo su iwui -
cd /default/
cd main
cd branch
cd branch2
cd WORKAREA
cd Content
etc

see where you fail.

Kevin_Huang

in order to make things simple, I write below perl code to the CGI:

system('mkdir /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir');

the error log is:
mkdir: Failed to make directory "/iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir"; Permission denied

Without seeing more details of both the source code and the error messages, it's difficult to determine what is happening / why it's happening.

Are you sure you're providing the right kind of path (file system path vs. vpath) and/or a writable path (workarea path vs staging area or edition path)? These may seem like simplistic questions but since you haven't provided real details that's where the questions have to start.

Kevin_Huang

I provide more details below:

I call a CGI in a DCT, the perl CGI will call a system command, the command need to generate a file under the target folder(within one workarea). In order to make things simple, I write below perl code to test:
system('touch /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_file');

and the log says:
touch: /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir cannot create

this target folder(ipad_resource) has 777 permission, and the owner is "iwui". I'm sure iwui is the user who runs the CGI and the group who runs the CGI is "nobody". And I'm sure iwui have "x" permission on each pre-directory.

I searched the forum, and found that: iwui doesn't belong to the group of the branch. But in my senario, iwui is not allowed to set as one group member of any branchs because of security reason. I set iwui as owner of the target folder, and read, write permission. I think iwui is the owner, so iwui has write permission, but I got above Permission Denied error.

Does there a way to let CGI write to the target folder without setting iwui to the branch's group? Thank you all in advance!

cute_guy

I provide more details below:

I call a CGI in a DCT, the perl CGI will call a system command, the command need to generate a file under the target folder(within one workarea). In order to make things simple, I write below perl code to test:
system('touch /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_file');

and the log says:
touch: /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir cannot create

this target folder(ipad_resource) has 777 permission, and the owner is "iwui". I'm sure iwui is the user who runs the CGI and the group who runs the CGI is "nobody". And I'm sure iwui have "x" permission on each pre-directory.

I searched the forum, and found that: iwui doesn't belong to the group of the branch. But in my senario, iwui is not allowed to set as one group member of any branchs because of security reason. I set iwui as owner of the target folder, and read, write permission. I think iwui is the owner, so iwui has write permission, but I got above Permission Denied error.

Does there a way to let CGI write to the target folder without setting iwui to the branch's group? Thank you all in advance!

How are you calling you CGI in the DCT?

There is a file called show_env.cgi @ iw-home\httpd\iw-bin, which displays environment variables, try running it and see what is the user id when cgi is invoked from DCT.

Kevin_Huang

I call the CGI when user save the DCT, code like this:

IWEventRegistry.addFormHandler("onSaveDone", handleSaveDone);
and In the JavaScript function handleSaveDone, I use this to call the CGI:
IWDatacapture.callServer("http://" + hostName + "/iw-bin/touch_file.ipl", params, true);

I executed the show_env.cgi, but I didn't find the user info.
Instead I use perl variable: $( and $< to show the user and group who runs the CGI, and it shows: user is iwui, group is nobody

How are you calling you CGI in the DCT?

There is a file called show_env.cgi @ iw-home\httpd\iw-bin, which displays environment variables, try running it and see what is the user id when cgi is invoked from DCT.

Adam Stoller

in order to make things simple, I write below perl code to the CGI:

system('mkdir /iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir');

the error log is:
mkdir: Failed to make directory "/iwmnt/NEW-CMS/main/CMS-PRD/WORKAREA/work/templatedata/ipad_content_browser/ipad_resource/test_dir"; Permission denied

Both your examples - this one an the 'touch' one - should use explicit paths to the executables ('mkdir' and 'touch') - though in the case of mkdir - you're better off using the File: Smiley Tongue

ath module's mkpath() routine.

The error messages seem to indicate that the correct program was found, so the above is not the source of the problem, just a recommendation for making sure.

You also might want to print out all of the UID/GID information:

to make sure that the effective ids are what you believe them to be.

Kevin_Huang

Thank you!
I should use absolute paths, I tried, but still failed.
And I got the UID and GID just as you recommanded: $<,$>,$(,$) and the user is iwui, group is nobody

[QUOTE=ghoti]Both your examples - this one an the 'touch' one - should use explicit paths to the executables ('mkdir' and 'touch') - though in the case of mkdir - you're better off using the File: Smiley Tongue

Kevin_Huang

Hi All,

Is it possible to change the user who runs the CGI? Such as change the user to the one who is editing the DCT?

Adam Stoller

Hi All,

Is it possible to change the user who runs the CGI? Such as change the user to the one who is editing the DCT?

You could try using iw_cgi_wrapper.cgi

Kevin_Huang

Yeah, I use iw_cgi_wrapper.cgi solved my issue.

Thank you all!

You could try using iw_cgi_wrapper.cgi