From: Parragh Szabolcs <parragh@...>
Date: 2007-01-19T00:59:21+09:00
Subject: mod_ruby security

--------------010303020703010803090801
Content-Type: text/plain; charset=ISO-8859-2; format=flowed
Content-Transfer-Encoding: 7bit

Hi,
I have a quiestion regarding mod_ruby security, hope someone might help 
me out.

Suppose, I have a local user on my server, who has a chroot jail, 
scponly web-home folder to upload .rhtml (or .rb) files, that apache 
executes by mod_ruby. At the default safe level (=1) he can execute code 
like:

% expr = %{File.read(\"/etc/postfix/main.cf\")}
% result = eval(expr)
% puts result

She can see globally readable files on the server while his code is 
running in the name of the apache user. The same happens with 
"RubySafeLevel 2". With 3 or 4, the user cannot access these files, but 
actually he cannot do anything reasonable at all, so that is not really 
an option. My question is, can I do something similar to PHP-s 
safe_mode, where the running _code_ is jailed into its folder somehow? 
Or any other solution?

Thx in advance!
PSz

p.s: changing acces rights of all files is s.g. I don't want to do 
(fighting debian file acc.rights policy on hundreds of files) that's why 
I like scponly/jailroot


-- 
Parragh Szabolcs
e-mail: parragh@dayka.hu
web: parszab.nir.hu


--------------010303020703010803090801--