httpd-modules-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bartov, Asaf" <>
Subject RE: Dynamic registration of a module in Apache 2.X?
Date Wed, 29 Nov 2006 15:31:20 GMT
Thanks for the response!

I managed to get Marketing to drop the idea, happily.

You're quite right about the security concerns attendant upon this.  My
comment about IIS was meant only to better explain the feasibility of
*what* I was trying to find out, not to extol IIS's virtues over Apache
(I think it has very few indeed.)  I run Apache exclusively on my
personal projects.

Thanks again for your help!


-----Original Message-----
From: Nick Kew [] 
Sent: Wednesday, November 29, 2006 4:44 PM
Subject: Re: Dynamic registration of a module in Apache 2.X?

On Wed, 29 Nov 2006 16:27:23 +0200
"Bartov, Asaf" <> wrote:

> Hello.
> Is it possible to dynamically register a new module (given some
> in a *running* httpd process, to get it to work
> *without* writing to the config file or restarting the httpd process?
> Essentially, to inject a module into a running httpd process, given 
> appropriate, even root, permissions.

Not off-the-shelf, but there are third-party modules that'll load and
unload .so s in a running server.  Of course it's a big security issue.
And, also for security reasons, you can't do everything a module can do:
the running server has dropped the system privileges it had at startup.

> As far as I can tell, this is not possible.  I'm asking after  
>implementing this on Microsoft's IIS, where one can change the 
>so-called  "metabase" and have the changes take effect immediately.

IIS had Nimda, codered, et al.  Apache, with three times IIS's market
share, didn't.  Apache will let you shoot yourself in the foot, but
unlike IIS (or PHP) it won't hand a loaded gun with no safety cache to
an admin who has no clue about using it.

Nick Kew

Application Development with Apache - the Apache Modules Book

View raw message