![Suexec:无效命令错误](https://linux22.com/image/711582/Suexec%EF%BC%9A%E6%97%A0%E6%95%88%E5%91%BD%E4%BB%A4%E9%94%99%E8%AF%AF.png)
我正在尝试使用 suexec 设置 lighttpd,但测试时出现问题:当我尝试通过 suexec 启动某些东西时,它会在日志中给出:
[2017-10-08 00:23:24]: invalid command (/srv/http/main/htdocs/cgi-bin/test.py)
输出suexec -V
:
-D AP_DOC_ROOT="/srv/http"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="lighttpd"
-D AP_LOG_EXEC="/var/log/lighttpd/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX="public_html"
我用来启动程序的包装器:
#!/bin/bash
filename="$1"
user="$(/usr/bin/stat -c "%U" "$filename")
group="$(/usr/bin/stat -c "%G" "$filename")
cd "$(dirname "$filename")"
/usr/local/bin/suexec "$user" "$group" "$filename"
权限没问题,没有设置恶意写入位。尝试从用户目录 ( /home/$USER/public_html
) 和文档根目录进行操作。
答案1
似乎只允许相对路径;错误消息来自这个块:
/*
* Check for a leading '/' (absolute path) in the command to be executed,
* or attempts to back up out of the current directory,
* to protect against attacks. If any are
* found, error out. Naughty naughty crackers.
*/
if ((cmd[0] == '/') || (!strncmp(cmd, "../", 3))
|| (strstr(cmd, "/../") != NULL)) {
log_err("invalid command (%s)\n", cmd);
exit(104);
}
(看https://anonscm.debian.org/cgit/pkg-apache/apache2.git/tree/support/suexec.c?h=upstream/2.4.27#n350)