Full Disclosure mailing list archives
Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature
From: halfdog <me () halfdog net>
Date: Fri, 24 Jun 2011 17:50:29 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ferenc Kovacs wrote:
On Fri, Jun 24, 2011 at 5:24 PM, Christian Sciberras<uuf6429 () gmail com> wrote:I think you meant "apache follows symlinks even when -FollowSymLinks is not set". Otherwise it doesn't seem to make sense?-FollowSymLinks turns off the FollowSymLinks option without resetting the other Options. http://wiki.apache.org/httpd/FAQ#Why_do_my_Options_directives_not_have_the_desired_effect.
The
FAQ says: "You can usually avoid problems by either finding the Options directive that already applies to a specific directory and changing it, or by putting your Options directive inside the most specific possible <Directory> section." The option is in the most specific directory section and it also takes effect, returning forbidden on http request. But when you use the RenameLoop program in parallel, it fails to detect the symlink and delivers the linked data. This specific TOCTOU issue is known and part of the apache specification. - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFOBM5jxFmThv7tq+4RAoLbAJ9JUlpXxGM6vXOBIP7fQZgVphdn+wCcDv8O Hu4gjjxAONZm6KU8vrTE+m8= =L1O7 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Ferenc Kovacs (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature halfdog (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Ferenc Kovacs (Jun 24)
- Re: FYI: Apache httpd NoFollowSymLink follows symlinks feature Christian Sciberras (Jun 24)