[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: SELinux vs BackupPC web interface

George Avrunin wrote:
On Fri, 16 Nov 2007 12:49:55 +0900 John Summerfield
<debian herakles homelinux org> wrote:

I take it the script begins

Change it to
and see what you see.

No, it begins #!/usr/bin/perl but it needs to run suid to access the backups.
[~] 11) l -lZ /var/www/cgi-bin/BackupPC/
-rwsr-x---  backuppc apache system_u:object_r:httpd_sys_script_exec_t:s0

I think your phrase "fix properly" meas you need to learn how to write a local policy to allow it.

This same script worked in FC6.

There's been some tension (to my mind at least) between Linux[1] (setuid is ignored with scripts) and perl (stuff Linux, we're going to do setuid scripts).

[1] I don't think Linux is alone here.

What I have done, in Debian and without selinux, where I want CGI to do root stuff is to authorise it without passwords via sudo,



-- spambait
1aaaaaaa coco merseine nu  Z1aaaaaaa coco merseine nu
-- Advice

Please do not reply off-list

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]