[Please Cc me on any replies, I'm not subscribed to the list]
Hi,
I'd like to request the inclusion of the ITK MPM (mpm-itk) as an official MPM
in the Apache tree, for Apache 2.4/3.0. mpm-itk is basically a modified
prefork allowing each vhost to run as a different uid/gid, ie. sort of like
what perchild was supposed to do. The biggest differences between mpm-itk and
perchild/Metux/peruser are:
- mpm-itk is in production use at several sites -- for instance, most sites
under .ntnu.no generally use mpm-itk, totaling about nine million hits a
day. Even though it is still under experimental/ in the tree, most real
issues have long since been ironed out -- it is not a proof-of-concept,
but a real, working tool. It works flawlessly with SSL and most
third-party modules (mod_ruby being a notable exception).
- mpm-itk is not threaded, which means you can run the full range of evil
third-party modules (such as PHP and its extensions) without problems.
- mpm-itk does not require any sort of special kernel modules or
configuration. It should generally work on the same platforms as prefork
does, given that it's a direct prefork descendent. It's a pluggable
replacement for prefork; most sites wouldn't really notice the difference
if you took out prefork and replaced it with mpm-itk, until you start
actually using AssignUserID. This provides a smooth migration path.
Two main disadvantages should be noted:
- setuid() happens after the request has been parsed, which means that the
server runs as root up until that point. (However, on a system with
capabilities, ie. Linux 2.6, almost all superuser privileges are dropped,
so you can't just load kernel code or whatever.)
- There is a performance drop from prefork, as each child is only serving
one connection before it dies -- I haven't done any detailed benchmarking
on this, but my general impression is: If you're serving static content
and you're strained for performance, it matters. If you're serving dynamic
content or large static files, it probably just disappears in the equation.
Despite these disadvantages, I believe it would be a useful addition to the
upstream tree -- these are largely results of design decisions in order to
keep the design as close to prefork as possible, instead of designing a new
grand scheme that will take a lot of time to get right. mpm-itk is included
in at least Debian, Ubuntu, Gentoo, and in FreeBSD ports, and based on the
numbers from Debian's popularity contest (which is not a statistically valid
sample, but nevertheless a good indication) is the third most popular MPM
(after prefork and worker, but clearly ahead of event).
The full set of patches, against Apache 2.2.3, is available from
http://home.samfundet.no/~sesse/mpm-itk/apache2.2-mpm-itk-2.2.3-04/
I'll of course be happy to update these to apply against HEAD if needed,
transfer copyright to the ASF, and write any needed documentation. However,
given that the "runs as root" issue has proved somewhat controversial
earlier, I don't think it's appropriate to do that kind of upstream
integration work before some kind of decision has been made :-)
/* Steinar */
--
Homepage: http://www.sesse.net/
|