Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of nickgearls@gmail.com
 designates 66.249.92.170 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=pynO+tdjv33G7aBp5y3+Xdh3DFE05mhPjt2Cbt7N0KLDg9e7tIdIEQPgu8LCkVR9kkyLRwQjrJ3wgo5hAFpC3EWwPn/EXijDz2APfA8ScK7Rdystoh5QWEAjZz7TCeugLttu002JL3N2YJt2VITJzeWPFYi4bhc1y46m/xUnirs=
Message-ID: <48206761.3060904@gmail.com>
Date: Tue, 06 May 2008 16:12:49 +0200
From: Nick Gearls <nickgearls@gmail.com>
User-Agent: Thunderbird 2.0.0.14 (Windows/20080421)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: High security
References: <4798802F.4070308@gmail.com>
 <20080124121627.GA23588@infiltrator.gizzard.com>
 <99EA83DCDE961346AFA9B5EC33FEC08B464143@VF-MBX11.internal.vodafone.com>
 <4798B4FB.8000208@gmail.com> <4798F60D.60001@apache.org>
 <479F420B.7020705@gmail.com> <48205CAD.6080600@gmail.com>
 <EF737DEA-A0F9-4343-B2F6-BEE3208ADF7B@webweaving.org>
In-Reply-To: <EF737DEA-A0F9-4343-B2F6-BEE3208ADF7B@webweaving.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

If there's a chance to add it, I'm ready to write the doc patch

Nick


Dirk-Willem van Gulik wrote:
> 
> On May 6, 2008, at 3:27 PM, Nick Gearls wrote:
> 
>> Just a little adding: by adding "LoadFile libgcc_s.so.1" in 
>> httpd.conf, I don't have any more file in the chroot (except "htdocs" 
>> if not in pure proxy mode).
> 
> Is there a patch for the docs as well ? Including above trick ?
> 
>>
>>
>> Nick Gearls wrote:
>>> I'm running the patch for one week on a production server, and it 
>>> works perfectly (http://svn.apache.org/viewvc?view=rev&revision=611483).
>>> When using Apache as a reverse proxy, the chroot environment is 
>>> totally empty (except libgcc_s.so.1).
>>> Could we include this in next build ?
>>> As it is very limited (basically 3 basic function calls plus the 
>>> logging), it is trivial to review.
>>> +1
>>> Regards,
>>> Nick
>>> [... discussion about chroot effectiveness and letting the final 
>>> choice to the user to use it or not ...]
> 
>