diff -rupN suphp-0.7.2.old/src/Application.cpp suphp-0.7.2/src/Application.cpp --- suphp-0.7.2.old/src/Application.cpp 2014-09-03 16:56:29.892000003 +0300 +++ suphp-0.7.2/src/Application.cpp 2014-09-03 16:57:27.674000003 +0300 @@ -37,6 +37,11 @@ #include "Application.hpp" +#ifdef ENABLE_LVE +#include +#include +#endif + using namespace suPHP; @@ -422,6 +427,29 @@ void suPHP::Application::changeProcessPe throw (SystemException, SoftException, SecurityException) { API& api = API_Helper::getSystemAPI(); +#ifdef ENABLE_LVE +#ifndef SECURELVE_MIN_UID +#define SECURELVE_MIN_UID 100 +#endif + /* cagefs 2.0 suphp patch */ + void *lib_handle = dlopen("liblve.so.0", RTLD_LAZY); + if (lib_handle) { + Logger& logger = API_Helper::getSystemAPI().getSystemLogger(); + char *error; char error_msg[8192]; dlerror(); /* Clear any existing error */ + int (*jail)(struct passwd *, int, char*) = (int (*)(passwd*, int, char*)) dlsym(lib_handle, "lve_jail_uid"); + if ((error = dlerror()) != NULL) { + std::string err("Failed to init LVE library "); + err += error; logger.logWarning(err); + throw SoftException(err, __FILE__, __LINE__); + } + int result = jail(getpwuid(targetUser.getUid()), SECURELVE_MIN_UID, error_msg); + if (result < 0) { + std::string err("CageFS jail error "); + err += error_msg; logger.logWarning(err); + throw SoftException(err, __FILE__, __LINE__); + } + } +#endif // Set new group first, because we still need super-user privileges // for this api.setProcessGroup(targetGroup); diff -rupN suphp-0.7.2.old/src/Makefile.am suphp-0.7.2/src/Makefile.am --- suphp-0.7.2.old/src/Makefile.am 2014-09-03 16:56:29.892000003 +0300 +++ suphp-0.7.2/src/Makefile.am 2014-09-03 16:23:03.000000000 +0300 @@ -9,6 +9,10 @@ endif SUBDIRS = $(MAYBE_AP) DIST_SUBDIRS = apache apache2 +AM_CPPFLAGS = -DENABLE_LVE=1 +AM_CFLAGS = -DENABLE_LVE=1 +AM_LDFLAGS = -ldl + sbin_PROGRAMS = suphp suphp_SOURCES = API.cpp API.hpp API_Helper.cpp API_Helper.hpp API_Linux.cpp API_Linux.hpp API_Linux_Logger.cpp API_Linux_Logger.hpp Application.cpp Application.hpp CommandLine.cpp CommandLine.hpp Configuration.cpp Configuration.hpp Environment.cpp Environment.hpp Exception.cpp Exception.hpp File.cpp File.hpp GroupInfo.cpp GroupInfo.hpp IOException.cpp IOException.hpp IniFile.cpp IniFile.hpp IniSection.cpp IniSection.hpp KeyNotFoundException.cpp KeyNotFoundException.hpp Logger.cpp Logger.hpp LookupException.cpp LookupException.hpp OutOfRangeException.cpp OutOfRangeException.hpp PathMatcher.hpp PathMatcher.cpp ParsingException.cpp ParsingException.hpp PointerException.cpp PointerException.hpp SecurityException.cpp SecurityException.hpp SmartPtr.hpp SoftException.cpp SoftException.hpp SystemException.cpp SystemException.hpp UserInfo.cpp UserInfo.hpp Util.cpp Util.hpp