Skip to content

Commit 934e10c

Browse files
rlerdorfrlerdorf
committed
Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
a gid check instead of a uid check. @ - Add getmygid() and safe_mode_gid ini directive to allow safe mode to do @ a gid check instead of a uid check. (James E. Flemer, Rasmus)
1 parent 9869ecc commit 934e10c

10 files changed

+55
-4
lines changed

‎ext/standard/basic_functions.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,7 @@ function_entry basic_functions[] = {
268268
#endif
269269

270270
PHP_FE(getmyuid, NULL)
271+
PHP_FE(getmygid, NULL)
271272
PHP_FE(getmypid, NULL)
272273
PHP_FE(getmyinode, NULL)
273274
PHP_FE(getlastmod, NULL)
@@ -846,6 +847,7 @@ PHP_RINIT_FUNCTION(basic)
846847
BG(mmap_file) = NULL;
847848
#endif
848849
BG(page_uid) = -1;
850+
BG(page_gid) = -1;
849851
BG(page_inode) = -1;
850852
BG(page_mtime) = -1;
851853
#ifdef HAVE_PUTENV

‎ext/standard/basic_functions.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ typedef struct {
155155

156156
/* pageinfo.c */
157157
long page_uid;
158+
long page_gid;
158159
long page_inode;
159160
long page_mtime;
160161

‎ext/standard/pageinfo.c

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,10 @@ static void php_statpage(BLS_D)
4949

5050
pstat = sapi_get_stat();
5151

52-
if (BG(page_uid)==-1) {
52+
if (BG(page_uid)==-1 || BG(page_gid)==-1) {
5353
if(pstat) {
5454
BG(page_uid) = pstat->st_uid;
55+
BG(page_gid) = pstat->st_gid;
5556
BG(page_inode) = pstat->st_ino;
5657
BG(page_mtime) = pstat->st_mtime;
5758
}
@@ -70,6 +71,14 @@ long php_getuid(void)
7071
}
7172
/* }}} */
7273

74+
long php_getgid(void)
75+
{
76+
BLS_FETCH();
77+
78+
php_statpage(BLS_C);
79+
return (BG(page_gid));
80+
}
81+
7382
/* {{{ proto int getmyuid(void)
7483
Get PHP script owner's UID */
7584
PHP_FUNCTION(getmyuid)
@@ -85,6 +94,21 @@ PHP_FUNCTION(getmyuid)
8594
}
8695
/* }}} */
8796

97+
/* {{{ proto int getmygid(void)
98+
Get PHP script owner's GID */
99+
PHP_FUNCTION(getmygid)
100+
{
101+
long gid;
102+
103+
gid = php_getgid();
104+
if (gid < 0) {
105+
RETURN_FALSE;
106+
} else {
107+
RETURN_LONG(gid);
108+
}
109+
}
110+
/* }}} */
111+
88112
/* {{{ proto int getmypid(void)
89113
Get current process ID */
90114
PHP_FUNCTION(getmypid)

‎ext/standard/pageinfo.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,12 @@
2222
#define PAGEINFO_H
2323

2424
PHP_FUNCTION(getmyuid);
25+
PHP_FUNCTION(getmygid);
2526
PHP_FUNCTION(getmypid);
2627
PHP_FUNCTION(getmyinode);
2728
PHP_FUNCTION(getlastmod);
2829

2930
extern long php_getuid(void);
31+
extern long php_getgid(void);
3032

3133
#endif

‎main/main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,7 @@ PHP_INI_BEGIN()
213213
STD_PHP_INI_BOOLEAN("register_argc_argv", "1", PHP_INI_ALL, OnUpdateBool, register_argc_argv, php_core_globals, core_globals)
214214
STD_PHP_INI_BOOLEAN("register_globals", "1", PHP_INI_ALL, OnUpdateBool, register_globals, php_core_globals, core_globals)
215215
STD_PHP_INI_BOOLEAN("safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode, php_core_globals, core_globals)
216+
STD_PHP_INI_BOOLEAN("safe_mode_gid", "0", PHP_INI_SYSTEM, OnUpdateBool, safe_mode_gid, php_core_globals, core_globals)
216217
STD_PHP_INI_BOOLEAN("short_open_tag",DEFAULT_SHORT_OPEN_TAG, PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateBool, short_tags, zend_compiler_globals, compiler_globals)
217218
STD_PHP_INI_BOOLEAN("sql.safe_mode", "0", PHP_INI_SYSTEM, OnUpdateBool, sql_safe_mode, php_core_globals, core_globals)
218219
STD_PHP_INI_BOOLEAN("track_errors", "0", PHP_INI_ALL, OnUpdateBool, track_errors, php_core_globals, core_globals)

‎main/php_globals.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ struct _php_core_globals {
6868
zend_bool implicit_flush;
6969

7070
zend_bool safe_mode;
71+
zend_bool safe_mode_gid;
7172
zend_bool sql_safe_mode;
7273
zend_bool enable_dl;
7374

‎main/safe_mode.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#include "ext/standard/pageinfo.h"
3030
#include "safe_mode.h"
3131
#include "SAPI.h"
32+
#include "php_globals.h"
3233

3334

3435
/*
@@ -46,7 +47,7 @@ PHPAPI int php_checkuid(const char *filename, char *fopen_mode, int mode)
4647
{
4748
struct stat sb;
4849
int ret;
49-
long uid=0L, duid=0L;
50+
long uid=0L, gid=0L, duid=0L, dgid=0L;
5051
char *s;
5152

5253
if (!filename) {
@@ -120,6 +121,8 @@ PHPAPI int php_checkuid(const char *filename, char *fopen_mode, int mode)
120121
}
121122
if (duid == (uid=php_getuid())) {
122123
return 1;
124+
} else if (PG(safe_mode_gid) && dgid == (gid=php_getgid())) {
125+
return 1;
123126
} else {
124127
SLS_FETCH();
125128

@@ -129,7 +132,11 @@ PHPAPI int php_checkuid(const char *filename, char *fopen_mode, int mode)
129132
}
130133
}
131134

132-
php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid);
135+
if (PG(safe_mode_gid)) {
136+
php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid/gid is %ld/%ld is not allowed to access %s owned by uid/gid %ld/%ld", uid, gid, filename, duid, dgid);
137+
} else {
138+
php_error(E_WARNING, "SAFE MODE Restriction in effect. The script whose uid is %ld is not allowed to access %s owned by uid %ld", uid, filename, duid);
139+
}
133140
return 0;
134141
}
135142
}

‎php.ini-dist

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,11 +111,16 @@ allow_call_time_pass_reference = On
111111
;
112112
safe_mode = Off
113113

114+
; By default, Safe Mode does a UID compare check when
115+
; opening files. If you want to relax this to a GID compare,
116+
; then turn on safe_mode_gid.
117+
safe_mode_gid = Off
118+
114119
; When safe_mode is on, only executables located in the safe_mode_exec_dir
115120
; will be allowed to be executed via the exec family of functions.
116121
safe_mode_exec_dir =
117122

118-
; open_basedir if set limits all file operations to the defined directory
123+
; open_basedir, if set, limits all file operations to the defined directory
119124
; and below. This directive makes most sense if used in a per-directory
120125
; or per-virtualhost web server configuration file.
121126
;

‎php.ini-optimized

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,10 @@ allow_call_time_pass_reference = Off ; whether to enable the ability to force ar
8181

8282
; Safe Mode
8383
safe_mode = Off
84+
safe_mode_gid = Off ; By default, Safe Mode does a UID compare
85+
; check when opening files. If you want to
86+
; relax this to a GID compare, then turn on
87+
; safe_mode_gid.
8488
safe_mode_exec_dir =
8589
safe_mode_allowed_env_vars = PHP_ ; Setting certain environment variables
8690
; may be a potential security breach.

‎php.ini-recommended

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,10 @@ allow_call_time_pass_reference = Off ; whether to enable the ability to force ar
8181

8282
; Safe Mode
8383
safe_mode = Off
84+
safe_mode_gid = Off ; By default, Safe Mode does a UID compare
85+
; check when opening files. If you want to
86+
; relax this to a GID compare, then turn on
87+
; safe_mode_gid.
8488
safe_mode_exec_dir =
8589
safe_mode_allowed_env_vars = PHP_ ; Setting certain environment variables
8690
; may be a potential security breach.

0 commit comments

Comments
 (0)