| Summary: | LD_LIBRARY_PATH is missing in CGI scripts environment | ||
|---|---|---|---|
| Product: | Red Hat Software Collections | Reporter: | Petr Pisar <ppisar> |
| Component: | httpd24 | Assignee: | Luboš Uhliarik <luhliari> |
| Status: | CLOSED CANTFIX | QA Contact: | BaseOS QE - Apps <qe-baseos-apps> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | httpd24 | CC: | jorton, lkuprova |
| Target Milestone: | beta | ||
| Target Release: | 2.4 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Known Issue | |
| Doc Text: |
When SELinux is enabled, the LD_LIBRARY_PATH environment variable is not passed through to CGI scripts invoked by httpd. As a consequence, it is impossible to invoke executables from Software Collections enabled in the /opt/rh/httpd24/service-environment file from CGI scripts run by httpd. To work around this problem, set LD_LIBRARY_PATH as desired from within the CGI script.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-17 11:23:42 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Petr Pisar
2016-10-07 13:03:55 UTC
I tried to put "PassEnv LD_LIBRARY_PATH" on various places, but without success. It will never show in the environment. While "SetEnv FOO BAR" written on next line in the httpd configuration works. It looks like the LD_LIBRARY_PATH is handled specially in mod_cgi. If I add these directives into /opt/rh/httpd24/root/etc/httpd/conf/httpd.conf to pass all variable set when enabling rh-perl524 (scl enable rh-perl524 '/usr/bin/env | grep rh-perl | sort'): PassEnv LD_LIBRARY_PATH PassEnv MANPATH PassEnv PATH PassEnv X_SCLS Then all of them except LD_LIBRARY_PATH will be passed. I guess mod_cgi treats LD_LIBRARY_PATH specially. And all of that despite mod_env documentnation <http://httpd.apache.org/docs/current/mod/mod_env.html#passenv>. I suspect httpd to execute a CGI script via /sbin/suexec that is SUID, so ld-linux.so will ignore the LD_LIBRARY_PATH when linking /sbin/suexec. But in addition it will remove the variable from the environment, thus /sbin/suexec's child, the CGI script, will miss the LD_LIBRARY_PATH variable. If you could not find a proper fix, we would have to rebuild all collections to use RPATH in all of their ELF executable programs. How were you enabling perl524 in service-environment, Petr? I can't reproduce this, vanilla httpd.conf. [root@virt-el7sclY ~]# grep -v ^# /opt/rh/httpd24/service-environment HTTPD24_HTTPD_SCLS_ENABLED="httpd24 rh-perl524" [root@virt-el7sclY ~]# rpm -q httpd24-httpd httpd24-httpd-2.4.18-11.el7.x86_64 [root@virt-el7sclY ~]# rpm -V httpd24-httpd [root@virt-el7sclY ~]# curl -s http://localhost/cgi-bin/ptest | grep LD_LI LD_LIBRARY_PATH=/opt/rh/rh-perl524/root/usr/lib64:/opt/rh/httpd24/root/usr/lib64 The special case in httpd is to ensure specifically that LD_LIBRARY_PATH *is* passed through to CGI scripts as-is. You're right the suexec case will fail to pass through LD_LIBRARY_PATH, though, but suexec is *not* used by default (and is relatively rare these days). I know some people patch suexec to allow passing LD_LIBRARY_PATH... not sure what the right thing is there. I have the same versions as you and I have the very same line as you in the /opt/rh/httpd24/service-environment. I purged all the SCL packages and the /opt directory, installed packages the script and the service-environment again, and I still can reproduce it. I will try it again in a different virtual machine. Hmmm, weird. Can you check whether LD_LIBRARY_PATH is set in one of the httpd child processes when httpd24-httpd is running via /proc/XXXX/environ? Ah ha. I had SELinux permissive mode on for httpd_t. Without permissive mode, I can reproduce. I believe this is a deliberate result of SELinux policy, which clears LD_LIBRARY_PATH across the domain transition when the CGI script is exec'd (setting the "AT_SECURE" flag). https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/message/EQABLLVU4CS5H6AT56D7D5SQAXIZFZBH/ I'm not totally sure this is an appropriate default for the httpd_t->httpd_sys_script_t transition *for the httpd24 SCL*, but we don't have separate SELinux policy for httpd in RHSCL to base-RHEL. It's one line of policy to over-rule this, and this isn't something people are hitting frequently (I guess), just documenting it is an option. |