Error message due to nested setuids

[Hadmut Danisch]

Hi,

when running a simple command like

   su -s /bin/sh -c "/bin/date" www-data

I get an error message like

  pam_mount(spawn.c:128): error setting uid to 0

(I am just trying to figure out why /etc/cron.daily/lighttpd issues such error message every day...)

It seems as if all this pam stuff is meanwhile that nested and felted, that it fails to perform basic functionalities.

Furthermore, it might be dangerous to treat /var/www (which is the home directory of www-data) as a regular home directory, since - depending on your local configuration - the directory might be writable from outside, e.g. when using a web server as a writable server for streaming and other things with webdav. Once someone is able to write e.g. a .login or .profile into /var/www , running cronjobs with su www-data (like in /etc/cron.daily/lighttpd) might automatically execute commands written to the web server from outside, or perform other unintended functions through all that big pam pipeline.

Not a good idea...

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: login 1:4.1.4.2+svn3283-3ubuntu1
ProcVersionSignature: Ubuntu 2.6.38-11.48-generic 2.6.38.8
Uname: Linux 2.6.38-11-generic x86_64
Architecture: amd64
Date: Sun Aug 7 11:21:49 2011
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64 (20100427.1)
ProcEnviron:
 LANGUAGE=en_US:en
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/tcsh
SourcePackage: shadow
UpgradeStatus: Upgraded to natty on 2011-07-29 (9 days ago)