CODEWITHSUNDEEP
apacheperlcgi
Eric Chang
Eric Chang

Reputation: 56

Perl cgi script can not read a directory that has the same permission as its parent directory

I got a strange issue with our new Apache server. When my cgi script tries to read a directory, the system gives me permission denied:

CGI Script:

#!/usr/bin/perl 
print "Content-Type: Text/html\n\n";
# print `ls -altr / 2>&1`;
print `ls -altr /opt 2>&1`;
print `ls -altr /opt/NA 2>&1`;

this same code is working on our old apache server (v.2.2.15). I can get output for “/”, and “/opt”, but when I try to list “/opt/NA”, I got Permission Denied.

And I can not see any difference between these 2 directories:

[root@myapache ~]# curl -k https://10.14.13.1/cgi-bin/listfile.cgi

total 12
drwxr-xr-x.  2 root root    6 Aug 25  2018 rh
drwxr-xr-x.  9 root root  110 Aug 18 15:17 .             ##### this is the /opt
drwxr-xr-x.  5 root root 4096 Nov 18 14:22 chef
drwxr-xr-x.  5 root root   43 Nov 18 14:28 mcafee
drwxrwxr-x.  6 root root 4096 Nov 18 14:29 unified-monitoring-agent
drwxr-xr-x.  7 root root   80 Dec 16 14:59 McAfee
dr-xr-xr-x. 20 root root 4096 Dec 20 06:05 ..
drwxr-xr-x.  4 root root   32 Dec 20 06:05 isec
drwxr-xr-x.  4 root root   40 Jan 12 18:24 NA            ##### this is the /opt/NA
ls: cannot open directory /opt/NA: Permission denied

Any idea how this has become a problem ?

Upvotes: 1

Views: 153

Answers (1)

Eric Chang
Eric Chang

Reputation: 56

Thanks for the advice from Dave Mitchell, I did that and update the Security Context bit:

[root@nccm-prod-dr-mt5 opt]# ls -Z
drwxr-xr-x. root root system_u:object_r:usr_t:s0       chef
drwxr-xr-x. root root system_u:object_r:usr_t:s0       isec
drwxr-xr-x. root root system_u:object_r:usr_t:s0       mcafee
drwxr-xr-x. root root system_u:object_r:usr_t:s0       McAfee
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 NA
drwxr-xr-x. root root system_u:object_r:usr_t:s0       rh
drwxrwxr-x. root root system_u:object_r:usr_t:s0       unified-monitoring-agent

[root@nccm-prod-dr-mt5 opt]# chcon system_u:object_r:usr_t:s0 NA
[root@nccm-prod-dr-mt5 opt]# ls -Z
drwxr-xr-x. root root system_u:object_r:usr_t:s0       chef
drwxr-xr-x. root root system_u:object_r:usr_t:s0       isec
drwxr-xr-x. root root system_u:object_r:usr_t:s0       mcafee
drwxr-xr-x. root root system_u:object_r:usr_t:s0       McAfee
drwxr-xr-x. root root system_u:object_r:usr_t:s0       NA
drwxr-xr-x. root root system_u:object_r:usr_t:s0       rh
drwxrwxr-x. root root system_u:object_r:usr_t:s0       unified-monitoring-agent

And it is working now.

Upvotes: 1

Related Questions