Insecure dependency running setgid in Guts.pm

Hi.

I saw this error on the list Thu 4/15/2004, reported on RH9. I am seeing this on Solaris 9, Perl 5.8.3, RT 3.0.10.
I have seen this in several places, but this particular one (below) was while modifying a ticket and dropping a requestor from it.
I upgraded Locale::Maketext to 1.09, but got the error again. I have a number of users (about 20) hitting the RT servers (there are 3, load balanced with persistent sessions behind a VIP) fairly regularly through the day. I see this error probably about three times an hour or more. Anyone have any ideas? Also, I only saw this error after upgrading to 3.0.10 (from 3.0.9 for performance).

Thanks!
Brent

=========== ERROR =================

error: Insecure dependency in eval while running setgid at /usr/local/lib/perl5/5.8.3/Locale/Maketext/Guts.pm line 247.

context: …
243: unshift @code, “use strict; sub {\n”;
244: push @code, “}\n”;
245:
246: print @code if DEBUG;
247: my $sub = eval(join ‘’, @code);
248: die “$@ while evalling” . join(‘’, @code) if $@; # Should be impossible.
249: return $sub;
250: }
251:

code stack: /usr/local/lib/perl5/5.8.3/Locale/Maketext/Guts.pm:247
/usr/local/lib/perl5/5.8.3/Locale/Maketext.pm:195
/opt/rt3/lib/RT/CurrentUser.pm:360
/opt/rt3/lib/RT/Base.pm:97
/opt/rt3/lib/RT/Ticket_Overlay.pm:1601
/opt/rt3/lib/RT/Interface/Web.pm:1265
/opt/rt3/share/html/Ticket/ModifyPeople.html:49
/opt/rt3/share/html/autohandler:195

=========== END ERROR =================From: rt-users-bounces@lists.bestpractical.com
[mailto:rt-users-bounces@lists.bestpractical.com]On Behalf Of Jesse
Vincent
Sent: Thursday, April 15, 2004 1:51 PM
To: thuryn@aplis.cz
Cc: rt-users@lists.bestpractical.com
Subject: Re: [Rt-users] RT 3.0.10 on RH 9

What version of Locale::Maketext are you running with. If you upgrade to
the latest version, does it go away?

Ok. Another workaround is to use apache’s suexec functionality, rather
than setgid perl. The author of Locale::Maketext hasn’t been able to
track this issue yet.On Tue, Apr 20, 2004 at 02:55:35PM -0400, Parish, Brent wrote:

Hi.

I saw this error on the list Thu 4/15/2004, reported on RH9. I am seeing this on Solaris 9, Perl 5.8.3, RT 3.0.10.
I have seen this in several places, but this particular one (below) was while modifying a ticket and dropping a requestor from it.
I upgraded Locale::Maketext to 1.09, but got the error again. I have a number of users (about 20) hitting the RT servers (there are 3, load balanced with persistent sessions behind a VIP) fairly regularly through the day. I see this error probably about three times an hour or more. Anyone have any ideas? Also, I only saw this error after upgrading to 3.0.10 (from 3.0.9 for performance).

Thanks!
Brent

=========== ERROR =================

error: Insecure dependency in eval while running setgid at /usr/local/lib/perl5/5.8.3/Locale/Maketext/Guts.pm line 247.

context: …
243: unshift @code, “use strict; sub {\n”;
244: push @code, “}\n”;
245:
246: print @code if DEBUG;
247: my $sub = eval(join ‘’, @code);
248: die “$@ while evalling” . join(‘’, @code) if $@; # Should be impossible.
249: return $sub;
250: }
251:

code stack: /usr/local/lib/perl5/5.8.3/Locale/Maketext/Guts.pm:247
/usr/local/lib/perl5/5.8.3/Locale/Maketext.pm:195
/opt/rt3/lib/RT/CurrentUser.pm:360
/opt/rt3/lib/RT/Base.pm:97
/opt/rt3/lib/RT/Ticket_Overlay.pm:1601
/opt/rt3/lib/RT/Interface/Web.pm:1265
/opt/rt3/share/html/Ticket/ModifyPeople.html:49
/opt/rt3/share/html/autohandler:195

=========== END ERROR =================

-----Original Message-----
From: rt-users-bounces@lists.bestpractical.com
[mailto:rt-users-bounces@lists.bestpractical.com]On Behalf Of Jesse
Vincent
Sent: Thursday, April 15, 2004 1:51 PM
To: thuryn@aplis.cz
Cc: rt-users@lists.bestpractical.com
Subject: Re: [Rt-users] RT 3.0.10 on RH 9

What version of Locale::Maketext are you running with. If you upgrade to
the latest version, does it go away?

On Thu, Apr 15, 2004 at 11:39:52AM +0200, Tom Hurn wrote:

Hallo,
I get error below after upgrading RT to 3.0.10 and I click on
https://rt.aplis.com/Admin/Global/Template.html?Queue=0&Template=14

Error:
Insecure dependency in eval while running setgid
at /usr/lib/perl5/5.8.0/Locale/Maketext/Guts.pm line 247.

Trace begun at /usr/lib/perl5/site_perl/5.8.0/HTML/Mason/Exceptions.pm line
131
HTML::Mason::Exceptions::rethrow_exception(‘Insecure dependency in eval while
running setgid at /usr/lib/perl5/5.8.0/Locale/Maketext/Guts.pm line 247…^J’)
called at /usr/lib/perl5/5.8.0/Locale/Maketext/Guts.pm line 247
Locale::Maketext::_compile(‘RT::I18N::cs=HASH(0x958aa80)’, ‘M-Zprava vzoru
[_1]’) called at /usr/lib/perl5/5.8.0/Locale/Maketext.pm line 189

Tomáš Hurýn


This message is intended only for the use of the intended recipient and
may contain information that is PRIVILEGED and/or CONFIDENTIAL. If you
are not the intended recipient, you are hereby notified that any use,
dissemination, disclosure or copying of this communication is strictly
prohibited. If you have received this communication in error, please
destroy all copies of this message and its attachments and notify us
immediately.



The rt-users Archives

RT Developer and Administrator training is coming to LA, DC and Frankfurt this spring and summer.
http://bestpractical.com/services/training.html

Sign up early, as class space is limited.

Sorry, Jesse, don’t mean to be thick, but I can’t find much on this.
I have enabled suexec and the logs show it starting successfully with Apache, along with fastcgi and all that. However, I wasn’t convinced I was doing the right thing, since the files were still set as setgid.
I was guessing that I needed to strip the setgid permission from the mason_handler.fcgi file, but doing so caused a fastcgi error on Apache startup:

[Wed Apr 21 00:16:03 2004] [notice] suEXEC mechanism enabled (wrapper: /usr/local/apache/bin/suexec)
[Wed Apr 21 00:16:18 2004] [notice] FastCGI: process manager initialized (pid 9974)
[Wed Apr 21 00:16:18 2004] [warn] FastCGI: server “/opt/rt3/bin/mason_handler.fcgi” started (pid 9975)
[Wed Apr 21 00:16:19 2004] [notice] Apache configured – resuming normal operations
“/opt/rt3/bin/mason_handler.fcgi” started (pid 9983)
Can’t locate /opt/rt3/etc/RT_SiteConfig.pm in @INC (@INC contains: /opt/rt3/local/lib /opt/rt3/lib /usr/local/lib/perl5/5.8.3/sun4-solaris-thread-multi /usr/local/lib/perl5/5.8.3 /usr/local/lib/perl5/site_perl/5.8.3/sun4-solaris-thread-multi /usr/local/lib/perl5/site_perl/5.8.3 /usr/local/lib/perl5/site_perl .) at /opt/rt3/lib/RT.pm line 105.
Compilation failed in require at /opt/rt3/bin/mason_handler.fcgi line 28.
[Wed Apr 21 00:16:28 2004] [warn] FastCGI: server “/opt/rt3/bin/mason_handler.fcgi” (pid 9975) terminated by calling exit with status ‘13’

Thanks a million!

Ok. Another workaround is to use apache’s suexec functionality, rather
than setgid perl. The author of Locale::Maketext hasn’t been able to
track this issue yet.