[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#426426: marked as done (SetEnv PERL5LIB ... cleaned by suEXEC)

Your message dated Wed, 14 Dec 2011 00:12:56 +0100
with message-id <4EE7DBF8.1010008@toell.net>
and subject line SetEnv PERL5LIB ... cleaned by suEXEC
has caused the Debian Bug report #426426,
regarding SetEnv PERL5LIB ... cleaned by suEXEC
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
426426: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=426426
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: apache2
Version: 2.2.3-4
Severity: wishlist

I was recently burned by the fact suEXEC removes PERL5LIB from
processes' environment: http://httpd.apache.org/docs/2.2/suexec.html

I use SetEnv PERL5LIB ... to get CGIs loading perl modules from my home
directory. This works without suEXEC, but broke when I enabled suEXEC.

Assuming it is unreasonable to add PERL5LIB to the suEXEC safe
environment list (is it unreasonable?) could we please add a note in the
README.Debian?

Thanks, Jack

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.18-4-686 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages apache2 depends on:
ii  apache2-mpm-worker            2.2.3-4+b1 High speed threaded model for Apac

apache2 recommends no packages.

-- no debconf information

--- End Message ---
--- Begin Message --- 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

tags 426426 +wontfix
thanks

I'm closing this fix. As it was denoted previously adding PERL5LIB is
security-wise a bad idea. Not having PERL5LIB in the environment is by
design.


- -- 
with kind regards,
Arno Töll
IRC: daemonkeeper on Freenode/OFTC
GnuPG Key-ID: 0x9D80F36D
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJO59v3AAoJEMcrUe6dgPNte2kP/0iMprXy5mDPn/l2yM8W/WTr
aoSlp1KouLO1398cTrdjHwv1h504wiEhPz8MHol6AYY5HF7Mjx3IDVy2sNSeV5s2
qNlmbYf8snYqQxAl/iuOqei9cqt1SHa3I89UMBtGodpzTxlDHiM8mYh2PVO7HES5
MsE6rqMEm5dCD/SgnDGUrUMR9tgj8QUTsWUYdh2M9Yzm5UWcsBl40Qk2X9uqjphV
ltJBiHe6miCRfE0lmODSjeqFr6ezbF7AYBaB2CSwkxNRCONB/+/pt3C91+AcuEnV
jvIy+pSo0aKWDsHc5MziEGf7ZO4vFENCfLY3EFl9mmJTrE0XRDS3YBupKkBYCReR
mKntxgKCjDMS34Y44AlwikAnpnfzvVxmxZjHr291vrPMkS7iyynQVKJE7M73G6j5
tjFSt3TPxr/jIDOOGyMAF1EPufRSmCKa8BIrDY6Q67dpSLgGPAVai+D6G97OgZY7
orAArWbiDS2oK5kM7vC/3DzUdxFRTIsur/YyhUwM+hHGzM0YJxQwl7JmEM7z0j6s
wnZNhtsJOBLBB3QJIYhXbkBVJbu8yaJtJorlRicfYlsajfuP4lDZCVQFq8Yqj7Ri
WorMCqq++vObE6hP05EipWJNgFR0DKj3BgcgAVcKEH6QHRYN31teMfltAB5pfV6+
ZBBCMafol+kKSao+UFvN
=SRdY
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: