How to run somethings but without permissions to "by&qu

[shimano]

Hi!

I have a program /bin/something, which is generally hidden, that is

/ {
/bin/something h
}

and a script /bin/exec_something.php based on /usr/php-cgi/bin/php, which sets up by it's code /bin/something using function system() and/or shell_exec(). Of course I've set an access of the script to /bin/something, and that is

subject /bin/exec_something.php {
/bin/something rx
}

Unfortunately system() and shell_exec() perform commands from shell level and I get info:

(default:D:/bin/bash) denied access to hidden file /bin/something by /bin/bash[sh:12129] uid/euid:0/0 gid/egid:0/0, parent /bin/exec_something.php[exec_something.php:13600] uid/euid:0/0 gid/egid:0/0

Is it possible to make PHP script /bin/exec_something.php run the program /bin/something but without giving the access for /bin/bash ?

[Raf256]

Dunno if that will help, but there where some shells that can allow only predefined programs, and all other "illegal" instructions (or attempts to bypass the restriction) should be stoped

btw - what exacly do that rule do, it allows a program to execute other program? If I want to use it, where should I write the text you posted? Can I give simmilar restrictions to a user (like: user can or cant execute a program)? Where from do You learn grsecurity?

[spender]

You could use the nested subject functionality so that you could add a nested subject for /bin/bash that would only be applied when your php script executes bash (or another script) and in that /bin/bash subject you can restrict which files bash can open (and thus, which scripts it is allowed to execute)

-Brad

[andutt]

Code: Select all

subject /bin/exec_something.php:/bin/bash:/bin/something: {
/var/log/messages r
}


[Hue-Bond]

Is it possible to make PHP script /bin/exec_something.php run the program /bin/something but without giving the access for /bin/bash ?

Yes, it is. This is a PHP question, not a grsec one. Use exec() instead of system() or shell_exec().