When using exec() or proc_open() after posix_seteuid() or posix_setuid() I expected the resulting process to run as the UID I set inside the running script. This does not happen.
is this how it's supposed to work? I've worked around this by changing the user on the executed commandline, but it just seems like a security hole to change the UID and have exec() and proc_open() run things as root anyway.
Google searching has turned up nothing on this subject.
<?php
if (false === posix_setgid(1000)) echo "Could not setgid\n";
if (false === posix_setuid(1000)) echo "Could not setuid\n";
echo posix_getpwuid(posix_getuid())['name']."\n";
echo exec('echo $USER')."\n";
Was expecting:
# php test
ron
ron
Got instead:
# php test
ron
root
You should execute id -u or whoami command to inspect the current user. $USER is an environment variable which is initialized by the login command (see Who sets $USER and $USERNAME environment variables?). setuid or seteuid only changes the uid of the process.