Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • The advisory itself is rather vague and unhelpful. I'm surprised it exists at all. However it does provide an excellent opportunity to talk about Unix privileges and Perl. Randal, I hope you don't mind me using your journal too much for this purpose. ;)

    Dropping privileges in Perl is notoriously hard, and stems primarily from the fact that most unix systems provide at least three flavours of uid (real, effective, and saved), whereas Perl provides only two (real and effective). The saved uid, the one you can't easily access from Perl, is the effective uid when the process started. It exists so one can switch between real and saved uids throughout the course of a program.

    On many systems, the line:

    $< = $> = $NEW_UID;

    will permanently drop privileges to $NEW_UID, dropping the saved uid as well. However this may only happen if you're running as root. On most systems the lines:

    $< = $NEW_UID;
    $> = $NEW_UID;

    will not permanently drop privileges, even though it does set the real and effective uids. One can successfully regain privileges later in the program.

    Worse still, the values of $< and $> are cached, and may or may not actually have anything to do with the current process privileges. This makes it particularly difficult if you're relying upon calls out to C/XS to perform privilege manipulation.

    Proc::UID [cpan.org] is one attempt to try and provide sensible privilege semantics to Perl without the programmer needing to worry about the idiosyncrasies of each particular operating system. It makes available all three user-uids, without caching.

    Unfortunately to make Proc::UID truly effective I do need to worry about all the idiosyncrasies, and also to find a few spare round tuits, which always seem in short supply. Patches, particularly for non-Linux/BSD systems, are especially welcome.

    • Perl on MacOS (and possibly other BSDish platforms) *does* indeed have some unportable wierdness regarding uid/euid handing, as we found in this SpamAssassin bug report [apache.org].

      It appeared that some perl versions required RUID==EUID==0 before $ = 100; $" would silently fail to drop RUID==0 privs, and instead leave it at 0. To quote the bug report:

      Interestingly, the same exact issue occurs on my Mac OS X machine,
      but not any of the other platforms I have access to...

      root# perl -e 'sub p {print "RUID: $<,

      • 'It appeared that some perl versions required RUID==EUID==0 before $ = 100; $" would silently fail to drop RUID==0 privs, and instead leave it at 0.'

        well, that made no sense. sorry; forgot to escape $< and $>. anyway, read the pasted code; it's all pretty clear there.