Subversion Repositories suexec-custom

--- suexec.8.orig       2011-07-12 10:38:14.000000000 +0200

+++ suexec.8    2011-07-12 11:33:24.000000000 +0200

@@ -43,8 +43,12 @@ If suexec is called by a user with name

 suexec will abort. By creating several config files, you can allow several

 different apache run users to use suexec.

 .PP

-The first line in the file is used as the document root (/var/www in the

-standard suexec) and the second line in the file is used as the suffix that is

+The first line in the file is used as the start (the root) of the chroot

+jail environment. If you don't want to use a chroot jail you must put

+"nochroot" on the first line: the chroot command will be ignored.

+.PP

+The second line in the file is used as the document root (/var/www in the

+standard suexec) and the third line in the file is used as the suffix that is

 appended to users' home directories (public_html in standard suexec).

 .PP

 If any of the lines is commented out (with #), suexec will refuse the

--- suexec-custom.config.orig   2013-03-12 17:22:25.835049038 +0100

+++ suexec-custom.config        2013-03-12 17:29:10.583054086 +0100

@@ -1,7 +1,12 @@

+nochroot

 /var/www

 public_html/cgi-bin

-# The first two lines contain the suexec document root and the suexec userdir

-# suffix. If one of them is disabled by prepending a # character, suexec will

-# refuse the corresponding type of request. 

+# The first line contains the path of the chroot jail environment. Use the

+# special word nochroot if you don't want to use a chroot jail.

+# The second line contains the suexec document root and the third line the

+# suexec userdir suffix. If one of them is disabled by prepending a #

+# character, suexec will refuse the corresponding type of request.

+# You cannot comment out the first line: use a path for the chroot jail or

+# the nochroot parameter.

 # This config file is only used by the apache2-suexec-custom package. See the

 # suexec man page included in the package for more details.

--- suexec-custom.c.orig        2011-07-12 10:38:14.000000000 +0200

+++ suexec-custom.c     2011-07-12 11:32:59.000000000 +0200

@@ -288,6 +288,7 @@ int main(int argc, char *argv[])

     struct stat dir_info;   /* directory info holder     */

     struct stat prg_info;   /* program info holder       */

     int cwdh;               /* handle to cwd             */

+    char *suexec_chroot         = NULL;

     char *suexec_docroot        = NULL;

     char *suexec_userdir_suffix = NULL;

     char *filename              = NULL;

@@ -382,9 +383,10 @@ int main(int argc, char *argv[])

      * If not, error out.

      */

     filename = malloc(AP_MAXPATH+1);

+    suexec_chroot = malloc(AP_MAXPATH+1);

     suexec_docroot = malloc(AP_MAXPATH+1);

     suexec_userdir_suffix = malloc(AP_MAXPATH+1);

-    if (!filename || !suexec_docroot || !suexec_userdir_suffix) {

+    if (!filename || !suexec_chroot || !suexec_docroot || !suexec_userdir_suffix) {

         log_err("malloc failed\n");

        exit(120);

     }

@@ -399,6 +401,11 @@ int main(int argc, char *argv[])

        exit(123);

     }

+    if (!read_line(suexec_chroot, configfile)) {

+       log_err("Could not read chroot from %s\n", filename);

+       exit(300);

+    }

+

     if (!read_line(suexec_docroot, configfile)) {

        log_err("Could not read docroot from %s\n", filename);

        exit(124);

@@ -527,6 +534,15 @@ int main(int argc, char *argv[])

         exit(108);

     }

+    getcwd(cwd, AP_MAXPATH);

+    if (strcmp(suexec_chroot, "nochroot")) {

+        if (chroot(suexec_chroot)!=0) {

+            log_err("chroot on %s failed!\n", suexec_chroot);

+            exit(301);

+        };

+    };

+    chdir(cwd);

+

     /*

      * Change UID/GID here so that the following tests work over NFS.

      *