Bug 1443507

Description of problem:

###
### This needs to be addressed asap, as it breaks almost any production servers out there.
###

Proftpd uses the wrong userid to access the home directory of a virtual user.

This occures since last night, due to an update caused by the patch for AllowChrootSymlinks CVE ( or any other change coming with it )

As you can see in the strace at the end,  for the first access to the users designated home directory
in this case "/opt/root/home/brainwork/public_html" , uid 1000 guid 1001 is used, which is correct!

but for the second try:

[pid 32571] setgid(1001)                = 0
[pid 32571] geteuid()                   = 0
[pid 32571] setresgid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 99, -1)       = 0
[pid 32571] lstat("/opt/root/home/brainwork/public_html", 0x7ffee3d84dd0) = -1 EACCES (Permission denied)

"nobody" is used and this has to fail, because nobody does not have any permissions to access a users home directory.

As soon as "nobody" gets into a group used by the apache user to access userhome directories, proftpd starts to work again, confirming, that "nobody" is used to access the home directory.

Conlusion: 

The above strace shows, that at least the correct gid wants to be set, but it gets overwritten by "nobody(99)". 

This needs to be addressed asap, as it breaks almost any productions servers out there.

Version-Release number of selected component (if applicable):

proftpd-mysql-1.3.5e-1.fc24.x86_64
proftpd-1.3.5e-1.fc24.x86_64

Compile-time Settings:
  Version: 1.3.5e (maint)
  Platform: LINUX [Linux 4.9.13-100.fc24.x86_64 x86_64]
  Built: Mon Apr 10 2017 14:56:42 UTC


How reproducible:

works only if you use virtual user from a mysql db. 

Actual results:

Access denied , because uid 99 ( nobody ) is used

Expected results:

using the actual uid to access the users home directory.

Additional info:

# grep -E "(uid|gid|lstat|1000)" /tmp/log 


[pid 32571] geteuid()                   = 0
[pid 32571] setresgid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 0, -1)        = 0
[pid 32571] setresgid(-1, 0, -1)        = 0
[pid 32571] geteuid()                   = 0
[pid 32571] setresgid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 0, -1)        = 0
[pid 32571] setresgid(-1, 1001, -1)     = 0
[pid 32571] setresuid(-1, 1000, -1)     = 0
[pid 32571] lstat("/", {st_mode=S_IFDIR|0555, st_size=4096, ...}) = 0
[pid 32571] lstat("/opt", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
[pid 32571] lstat("/opt/root", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
[pid 32571] lstat("/opt/root/home", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0
[pid 32571] lstat("/opt/root/home/brainwork", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
[pid 32571] lstat("/opt/root/home/brainwork/public_html", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
[pid 32571] geteuid()                   = 1000
[pid 32571] setresuid(-1, 0, -1)        = 0
[pid 32571] setresgid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 0, -1)        = 0
[pid 32571] setresgid(-1, 0, -1)        = 0
[pid 32571] setgid(1001)                = 0
[pid 32571] geteuid()                   = 0
[pid 32571] setresgid(-1, 99, -1)       = 0
[pid 32571] setresuid(-1, 99, -1)       = 0
[pid 32571] lstat("/opt/root/home/brainwork/public_html", 0x7ffee3d84dd0) = -1 EACCES (Permission denied)
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32571, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
lstat("/etc/shutmsg", 0x7ffee3d85cb0)   = -1 ENOENT (No such file or directory)