in reply to Re^3: Apache/CGI fcould not use Spreadsheet::ParseExcel
in thread Apache/CGI fcould not use Spreadsheet::ParseExcel
So is Perl accessing modules without checking the surrounding directory?
Probably...
Yes. Why should it be done in any other way? Perl needs to read some files with known names. So for each file, it calls open(), perhaps through several layers of libraries. That may succeed or fail. Why should perl (or any other application) check directories for that? Even stat() and lstat() only need execute permission on all of the directories leading to the file passed to stat()/lstat(), no read permissions.
The operating system does check the directories, like the desired file, for sufficient permissions and other things. See "ERRORS" in open() and path_resolution.
The only reason for needing read permissions on a directory is when you need a list of file names, e.g. for an (insecure) plugin system that loads all files as plugins that match some criteria on file names.
Nevertheless, directories commonly have either both r and x bits sets, or none of them. Having only the r bit set does not make much sense, having only the x bit set may be useful in some security-related scenarios.
Alexander
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^5: Apache/CGI fcould not use Spreadsheet::ParseExcel
by LanX (Saint) on May 09, 2019 at 11:48 UTC | |
by afoken (Chancellor) on May 09, 2019 at 19:55 UTC |