httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jason A. Dour" <>
Subject Re: Opinions on CGI wrappers?
Date Tue, 28 May 1996 16:18:10 GMT

On Tue, 28 May 1996, Ben Laurie wrote:
> Anyone got any views on the best/right/etc CGI wrapper to use?

	I'm coding one for use with Apache.  I can say with certainty that
cgiwrap has more options at this point, but the goal for my product is
efficiency.  Instead of calling cgiwrap for a CGI call that subsequently
does paranoia/security checks, the server would have paranoia code within
it, and would only exec() should the server's paranoia be soothed.  8)

	mod_sucgi 0.1.0 (the first beta) is available at present from:

	mod_sucgi 0.2.0 (son of beta) should be available soon.  This
version should have more paranoia internal to the server...  The version
after this (plan beta from MotherSoft) should have better logging, etc.

> Do any of them use chroot() [he says, being extra paranoid]?

	No.  I'll give you the process we're operating on at present.

	1.  CGI?
	2.  UserDir CGI? (If no, punt to normal CGI use)
	3.  Backend SUID layer
	4.  Return.

	The next release will have:

	1.  CGI?
	2.  UserDir CGI? (if no, punt to normal CGI use)
	3.  Paranoia checks (If *any* fail, then punt out with error)
	4.  Backend SUID later
	5.  Return.

	Exactly what paranoia checks we'll be implementing is unclear.
If anyone has any comments/suggestions/requests regarding suCGI, then feel
free to email me.  In the next week or so I'll be finishing coding on Son
Of if you want to see something added, please email it to me.

	Again (just in case there are some rabid cgiwrap fans out there),
the goal for suCGI is *efficiency.*  suCGI is entirely an Apache-only
product, and we will not be porting it to other servers.  We are drooling
Apache fans here at UofL and MotherSoft, and so we coded a wrapper that
was more internalized than cgiwrap.  Cgiwrap will still have a
home...don't worry.  8P

+ Jason A. Dour                            +
| Programmer Analyst II      |
| Dept. of Radiation Oncology         Finger for Geek Code, PGP Public Key,|
+ University of Louisville            PJ Harvey info, and other stuff...   +

Version: 2.6.2


View raw message