创建新的 Expect 对象时，cgi-perl 文件中出现 Apache [PTY 错误]

发布于 2024-11-28 05:10:06 字数 1842 浏览 0 评论 0原文

我有一个 perl 脚本：

#!/usr/bin/perl -w
use DateTime;
use Expect; 
use IO::Pty;
use CGI::Fast;


while($q = new CGI::Fast){
    my $ip = $q->param('ip');
    my $folder = $q->param('folder');
    my $username = $q->param('username');
    my $password = $q->param('password');
    print "Content-type: text/html\r\n\r\n";
    print "<head>\n<title>FastCGI</title>\n\</head>";
    print "<h3> $ip - $folder - $username - $password </h3>";

my $ssh = new Expect;

if($ssh->spawn("ssh -q -l $username $ip")){
    print "<h4>Connexion OK</h4>";
    } else {
        print "Error\n";
        die "Connexion failed, $!";
    }
}

该脚本的执行在我的 Apache 错误日志中创建了一些错误：

[error] [client x.x.x.x] pty_allocate(nonfatal): posix_openpt(): Permission denied at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): getpt(): No such file or directory at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): openpty(): No such file or directory at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): open(/dev/ptmx): Permission denied at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] Cannot open a pty at /var/www/cgi-bin/cgi2.pl line 18, referer: http://y.y.y.y/login

我理解该错误，因为它说它无法打开 PTY（使用 new Expect 命令）。

这真的是一个权限问题（以及如何解决这个问题）还是不可能在 cgi 文件中使用 Expect 命令？

感谢您的建议....

原文

I have a perl script:

#!/usr/bin/perl -w
use DateTime;
use Expect; 
use IO::Pty;
use CGI::Fast;


while($q = new CGI::Fast){
    my $ip = $q->param('ip');
    my $folder = $q->param('folder');
    my $username = $q->param('username');
    my $password = $q->param('password');
    print "Content-type: text/html\r\n\r\n";
    print "<head>\n<title>FastCGI</title>\n\</head>";
    print "<h3> $ip - $folder - $username - $password </h3>";

my $ssh = new Expect;

if($ssh->spawn("ssh -q -l $username $ip")){
    print "<h4>Connexion OK</h4>";
    } else {
        print "Error\n";
        die "Connexion failed, $!";
    }
}

The execution of this script create some errors in my Apache'Error-log:

[error] [client x.x.x.x] pty_allocate(nonfatal): posix_openpt(): Permission denied at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): getpt(): No such file or directory at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): openpty(): No such file or directory at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] pty_allocate(nonfatal): open(/dev/ptmx): Permission denied at /usr/local/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi/IO/Pty.pm line 24., referer: http://y.y.y.y/login
[error] [client x.x.x.x] Cannot open a pty at /var/www/cgi-bin/cgi2.pl line 18, referer: http://y.y.y.y/login

I understand the error as it says it can't open a PTY (with the new Expect command).

Is it really a problem of permission (and how to fix that) or is it impossible to use the Expect command in a cgi file?

Thank for your advices....

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

小清晰的声音 2024-12-05 05:10:06

这是因为 httpd_sys_script_t 没有读取/写入 pty 的 selinux 权限，但以下 selinux 策略允许这样做：

policy_module(httpd_pty,1.0)
require {
    type httpd_sys_cript_t;
    type ptmx_t;
    class chr_file { read write };
}
allow httpd_sys_script_t ptmx_t:chr_file { read write };

您可以更改为 class chr_file rw_chr_file_perms; 和 allow httpd_sys_script_t ptmx_t:chr_file rw_chr_file_perms;，具体取决于您的 selinux 策略的最新版本。上面的宏适用于 rhel5，这一行的宏适用于 rhel6。

或者，来自 #selinux on freenode 的建议：

mkdir ~/myhttpd
cd ~/myhttpd
echo "policy_module(myhttpd,1.0.0) optional_policy(\` apache_content_template(myscript)')" > myhttpd.te
echo "/home/httpd/foo/cgi-bin/test.pl -- gen_context(system_u:object_r:httpd_myscript_script_exec_t,s0)" > myhttpd.fc
make -f /usr/share/selinux/devel/Makefile myhttpd.pp
sudo semodule -i myhttpd.pp

基本上，apache 策略有一种方法来创建您自己的内容类型。在上面的代码片段中为您的脚本创建内容类型。然后使用新的 avc 拒绝并添加到上面的策略文件 myhttpd.te 中。这将阻止您允许所有 httpd 进程访问 pty，仅访问您指定的进程。之后您可能会执行以下操作：

allow httpd_myscript_script_t ptmx_t:chr_file rw_chr_file_perms;

添加到 myhttpd.te （或任何您想要调用的模块）的末尾，然后重新编译和加载（上面的 make 和 semodule）。

This is because httpd_sys_script_t doesn't have selinux permissions to read/write a pty, but the following selinux policy will allow it:

policy_module(httpd_pty,1.0)
require {
    type httpd_sys_cript_t;
    type ptmx_t;
    class chr_file { read write };
}
allow httpd_sys_script_t ptmx_t:chr_file { read write };

You might be able to change to class chr_file rw_chr_file_perms;, and allow httpd_sys_script_t ptmx_t:chr_file rw_chr_file_perms;, depending on how recent your selinux policy is. The above will work with rhel5, the macro in this line will work with rhel6.

Or, from advice from #selinux on freenode:

mkdir ~/myhttpd
cd ~/myhttpd
echo "policy_module(myhttpd,1.0.0) optional_policy(\` apache_content_template(myscript)')" > myhttpd.te
echo "/home/httpd/foo/cgi-bin/test.pl -- gen_context(system_u:object_r:httpd_myscript_script_exec_t,s0)" > myhttpd.fc
make -f /usr/share/selinux/devel/Makefile myhttpd.pp
sudo semodule -i myhttpd.pp

Basically, the apache policy has a way to create your own content type. Create the content type for your script in the above code fragment. Then use your new avc denials and add to the policy file myhttpd.te above. This will keep you from allowing all httpd processes from accessing pty's, just the one you specify. You would probably do the following afterwards:

allow httpd_myscript_script_t ptmx_t:chr_file rw_chr_file_perms;

added onto the end of myhttpd.te (or whatever you want to call the module), and recompile and load (make and semodule above).

回复收藏 0 原文

酷到爆炸 2024-12-05 05:10:06

我相信这是 SELinux 问题，请检查您的日志中是否有 selinux 错误并相应地调整您的策略。

回复收藏 0 原文

一曲琵琶半遮面シ 2024-12-05 05:10:06

这将解决您的问题：

cat > mypol.te<<EOF
module mypol 1.0;
require {
        type httpd_sys_script_t;
        type ptmx_t;
        type httpd_t;
        class chr_file { read write ioctl open };
}

#============= httpd_t ==============
allow httpd_t ptmx_t:chr_file open;
allow httpd_sys_script_t ptmx_t:chr_file { read write };
#!!!! This avc is allowed in the current policy
allow httpd_t ptmx_t:chr_file { read write ioctl };
EOF
checkmodule -M -m -o mypol.mod mypol.te
semodule_package -o mypol.pp -m mypol.mod
semodule -i mypol.pp

setsebool -P daemons_use_tty 1

grep httpd /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

This will solve your problem:

cat > mypol.te<<EOF
module mypol 1.0;
require {
        type httpd_sys_script_t;
        type ptmx_t;
        type httpd_t;
        class chr_file { read write ioctl open };
}

#============= httpd_t ==============
allow httpd_t ptmx_t:chr_file open;
allow httpd_sys_script_t ptmx_t:chr_file { read write };
#!!!! This avc is allowed in the current policy
allow httpd_t ptmx_t:chr_file { read write ioctl };
EOF
checkmodule -M -m -o mypol.mod mypol.te
semodule_package -o mypol.pp -m mypol.mod
semodule -i mypol.pp

setsebool -P daemons_use_tty 1

grep httpd /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

回复收藏 0 原文

~没有更多了~