October 3, 2010
SUID Executables

From time to time someone asks in Cherokee’s mailing list how to run a CGI with a different user than the one running Cherokee.

It’s a problem, because once Cherokee has dropped privileges and it’s being run, let’s say, by www-data user, it can’t run the CGI as a different user because that can be done only by root.

This morning I thought about SUID executables, which using a special bit in the file system, can be executed as a different user without being root. For example:

$ cp /usr/bin/id myid
$ sudo chown nobody:nobody myid
$ sudo chmod +s nobody:nobody myid
$ ./myid 
uid=500(reidrac) gid=500(reidrac) euid=99(nobody) egid=99(nobody) grupos=11(cdrom),63(audio),500(reidrac) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Thanks to the SUID bit I’m running the id executable using a different user (nobody in this case), and I don’t need to be root.

This can be an obvious security problem, so most UNIX systems doesn’t allow to run SUID scripts.

But anyway, it would be interesting to have a tool that allows a user to run a set of commands as a different user (yes, you got it: SUDO), so I wrote a small tool to do it: suidexec (yes, I know it’s not a great name).

I’ve used GLib to parse a configuration file to provide a simple ACL mechanism, and it can be used as easy as:

  1. Copy the tool into a different name, for example: suidexec_cgi.
  2. Setup the file system permissions: chown nobody:nobody suidexec_cgi && chmod +s suidexec_cgi.
  3. Edit /etc/suidexec.conf to allow www-data to run your CGI: 
    [suidexec_cgi]
commands = /var/www/cgi/mycgi.pl
www-data = true
  4. Configure Cherokee to run the CGI wrapped in suidexec: suidexec_cgi /var/www/cgi/mycgi.pl -- extra_argument.

I don’t know if it’s a good idea (kind of reinventing the wheel), but it’s easier to setup than SUDO and may be it’ll be useful for someone.

by jjm on 3:23pm  |   URL: http://tmblr.co/ZPorZy19eiJl
(View comments) 
Filed under: Cherokee suidexec C Hack SUDO SUID 
March 7, 2010
Use OSS to Prove Experience

After some years of working in different positions and lots of projects, you will realize that you tend to specialisation and that is difficult to get new projects.

For example, when I joint my current company, my profile was very sysadm oriented, and it was kind of hard to prove I’m not a bad programmer (IMHO, I started programming when I was 13).

When you do that thing you’re known to do well, you’ll be more focused to do it again and again. Call it ultra-specialisation or just “you’ve been typecasted”.

Just in case you want to change your role a little bit, you’ll see that it’s very difficult, because your CV shows you as hardcore sysadm. Then it’s when open source software can help you in your career.

About two months ago I realized that I’ve never been a significant contributor for any open source project. I’ve submitted small patches every now and then, but nothing noticeable that I could highlight in my CV. Although I’ve been programming for almost 20 years of my life, to different degrees of programming, I don’t have enough stuff to prove that I can program professionally in some areas (OK, may be bogom; but it’s small and with little interest right now).

So I started to look for a interesting project to be involved in, for at least 4 hours a week, and contribute as much as I can so I can fix that gap in my CV.

Finally, my target is Cherokee, and I’ve started to work hard in reading the code, and I’ve been successful fixing two small bugs that required deep code reading (aka 1 hour of code reading though the tree to write a two line fix).

I think I’ll be comfortable with the code in a pair of weeks, so I will need less that 4 hours week to be productive (but I like it, so I wouldn’t mind spending more time hacking on it heh).

What do you think? Is this a good idea to improve your CV?

by jjm on 9:58am  |   URL: http://tmblr.co/ZPorZyPmSQc
(View comments) 
(Notes: 1)
  
Filed under: open source oss career cv experience adopt a project hack cherokee 
January 12, 2010
Cherokee Summit 2010 will be held in Madrid, Spain on May 7th and 8th 2010.

I’ve started using Cherokee recently, in my home server (Sacando brillo al servidor, Spanish post), and I’m very pleased with it.

I’d like to go to this summit, but unfortunately it won’t be possible.

by jjm on 10:49am  |   URL: http://tmblr.co/ZPorZyJiHml
(View comments) 
Filed under: Cherokee Summit Cherokee Summit 2010 Madrid Web