Re: "Insecure dependency in eval while running setgid" error

[Fred Moyer <suppressed>]

Charlie Katz wrote:
> Hi All,
>
> I've been following this discussion closely because I had what seems to be the 
> same problem Sagar is having.
> I started greping around in the mod_perl source code (I have 2.0.2) and found 
> this in modperl_perl.c:
>
> --------------------------------------------------------------------------------------------
> static void modperl_perl_ids_get(modperl_perl_ids_t *ids)
...
>     ids->euid = geteuid(); 
>     ids->gid  = getgid(); 
>     ids->gid  = getegid(); 
> --------------------------------------------------------------------------------------------
> I changed that last line to
>
>    ids->egid = getegid();
>
> then rebuilt/reinstalled/restarted, and the EGID problem is gone.  
>
> I checked the 2.0.3 source and found this already fixed there.

Great catch - this was fixed by Gozer about a year ago, and is in 2.0.3 
but not in 2.0.2.

svn annotate:

 68564      dougm     ids->gid  = getgid();
384969      gozer     ids->egid  = getegid();

svn log src/modules/perl/mod_perl.c

------------------------------------------------------------------------
r384969 | gozer | 2006-03-10 16:41:10 -0800 (Fri, 10 Mar 2006) | 5 lines

Fixes a small typo that would leave ids->egid
uninitialized and cause PL_egid to get corrupted
as a result.