http://www.perlmonks.org?node_id=623878

stefan k has asked for the wisdom of the Perl Monks concerning the following question:

Fellow Monks,

the situation at hand is a CGI script which needs to be run as a certain user and which has to call several commands only available to that user using shared libraries found in the users LD_LIBRARY_PATH.

Lucky are those who have Apache2 which ships with mod_suexec by default, but not alas! on the system I have to work on.

Next I tried to run that CGI script suid to the user in question (not root), I went through the perlsec manpage, cleaned my path and other environments and untained all the input until finally the script would start and try to call the external command (using system()). Then the dynamic linking failed. I tried to set $ENV{'LD_LIBRARY_PATH'}, I preceded the actual command with the variable like this:

my $cmd = "LD_LIBRARY_PATH=/path/to/libs command arg1 arg2"; system($cmd) and die "..";
but to no avail. Any pointers, hints and tips welcome. Can you help me out?

Update: Fixed the typo in the title.

Regards... stefan k
you begin bashing the string with a +42 regexp of confusion