Kiyokazu in (hopefully) hacker mode (A patch to wrfmwrap.c in WebRFM-0.4)

A patch to wrfmwrap.c in WebRFM-0.4

WebRFM-0.4.diff.gz (5KB, 2003-04-28 10:24:14)

makes the setuid 0'ed wrapper of WebRFM(-0.4) to be configurable at run-time.

Configuration data are read from the file /etc/<basename part of the wrapper>.conf, The file must consist of the keywords followed by 1 or 2 arguments, which are separated 1 or more spaces. The available keywords are as follows (all case-sensitive).

HTTPD_UID: Requires one uid under which the wrapper must run.
SCRIPT: Requires one string which denotes a full path to the main WebRFM script.
UID_MIN: Requires one uid minimal among acceptable uids.
GID_MIN: Requires one gid minimal among acceptable gids.
REMOTE_USER: Requires one string which is the name of an environment variable from which the wrapper derives a user name.
USER: Requires one string which is the name of an environment variable to which the wrapper assigns the user name for the main WebRFM script.
HOME: Requires one string which is the name of an environment variable to which the wrapper assigns the name of virtual root directory for the main WebRFM script.
VHOME: Requires two strings. The first one is a name of a directory which will be treated as the virtual root by the main WebRFM script. The second is ":" (semi-colon) separated list of user names or group names with leading "@" (atmark signs). If the user derived from REMOTE_USER appears in the list or is a member of a group in the list, the virtual root will be set to the first argument.
EXTENV: Requires two strings. The second argument is assigned to the environment variable of which name is the first one.

For the argument of "HOME", for the first argument of "VHOME", and for the second argument of "VHOME", environment variable expansions are performed. That is, any substring of the form

"$" (dollar sign) + <name of an environment variable>

"$" (dollar sign) + "{" (opening brace) + <name of an environment variable> + "}" (closing brace)

is substituted with the value of the environment variable.

Any questions or comments about this page are greatly appreciated.

Almost all contents in this site are written by Kiyokazu SUTO (i.e. me) unless especially noted. I want to put all of them into the PUBLIC DOMAIN, even though some lawyers mention that it is impossible in my country.