httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Nick Kew <n...@webthing.com>
Subject Re: Question about mod_privileges
Date Tue, 05 Jul 2011 12:08:07 GMT

On 4 Jul 2011, at 21:06, Rainer Jung wrote:

> When testing 2.3.13 I built mod_privileges. I notices that I couldn't
> load it if the process was run by a non root user.
> 
> Platform was Solaris 10, and the problem was, that the module wants to
> add proc_setid to PRIV_PERMITTED. Of course the module needs this
> privilege to work and a normal user doesn't have it.
> 
> What's the suggested way to handle this? Run as root, or assign the
> proc_setid privilege to the chosen runtime user? Are there any caveats?

Solaris gives you the choice of running as root or as a user with pfexec,
subject to the privileges you have with the latter.  The bottom line with it
is that whatever privileges httpd will need in request processing have to
be available as startup.

Setid is a special case, because setting userid per-request is a core
capability (which, as the perchild story has shown, everyone wants).
It is of course a compromise, and I tried to be very clear about that
in the security discussion in the documentation.  I guess if you do want
to update it, the caveat is to take great care over the security warnings!

-- 
Nick Kew

Available for work, contract or permanent
http://www.webthing.com/~nick/cv.html


Mime
View raw message