mirror of
https://github.com/apache/httpd.git
synced 2025-07-29 12:37:06 +00:00
Introduce mod_privileges: a platform-specific module offering enhanced
security and a (limited) solution to the "perchild" problem. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@713961 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Nick Kew
280
docs/manual/mod/mod_privileges.xml
Normal file
280
docs/manual/mod/mod_privileges.xml
Normal file
@ -0,0 +1,280 @@
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
|
||||
<?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
|
||||
<!-- $LastChangedRevision: 703441 $ -->
|
||||
|
||||
<!--
|
||||
Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
contributor license agreements. See the NOTICE file distributed with
|
||||
this work for additional information regarding copyright ownership.
|
||||
The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
(the "License"); you may not use this file except in compliance with
|
||||
the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
-->
|
||||
|
||||
<modulesynopsis metafile="mod_privileges.xml.meta">
|
||||
|
||||
<name>mod_privileges</name>
|
||||
<description>Support for Solaris privileges and for running virtual hosts
|
||||
under different user IDs.</description>
|
||||
<status>Experimental</status>
|
||||
<identifier>privileges_module</identifier>
|
||||
<compatibility>Available in Apache 2.3 and up, on Solaris 10 and
|
||||
OpenSolaris platforms</compatibility>
|
||||
|
||||
<summary>
|
||||
<p>This module enables different Virtual Hosts to run with different
|
||||
Unix™ <var>User</var> and <var>Group</var> IDs, and with different
|
||||
<a href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>Solaris Privileges</a>. In particular, it offers a solution to the
|
||||
problem of privilege separation between different Virtual Hosts, first
|
||||
promised by the abandoned <module>perchild</module> MPM.
|
||||
It also offers other security enhancements.</p>
|
||||
|
||||
<p>Unlike <module>perchild</module>, <module>mod_privileges</module>
|
||||
is not itself an MPM. It works <em>within</em> a processing model to
|
||||
set privileges and User/Group <em>per request</em> in a running process.
|
||||
It is therefore not compatible with a threaded MPM, and will refuse
|
||||
to run under one.</p>
|
||||
|
||||
<p><module>mod_privileges</module> raises security issues similar to
|
||||
those of <a href="../suexec.html">suexec</a>. But unlike suexec,
|
||||
it applies not only to CGI programs but to the entire request processing
|
||||
cycle, including in-process applications and subprocesses.
|
||||
It is ideally suited to running PHP applications under <strong>mod_php</strong>,
|
||||
which is also incompatible with threaded MPMs. It is also well-suited
|
||||
to other in-process scripting applications such as <strong>mod_perl</strong>,
|
||||
<strong>mod_python</strong>, and <strong>mod_ruby</strong>, and to
|
||||
applications implemented in C as apache modules where privilege
|
||||
separation is an issue.</p>
|
||||
|
||||
</summary>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostUser</name>
|
||||
<description>Sets the User ID under which a virtual host runs.</description>
|
||||
<syntax>VHostUser <var>unix-userid</var></syntax>
|
||||
<default>Inherits the userid specified in
|
||||
<directive module="mod_unixd">User</directive></default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
|
||||
|
||||
<usage>
|
||||
<p>The <directive>VHostUser</directive> directive sets the Unix userid
|
||||
under which the server will process requests to a virtualhost.
|
||||
The userid is set before the request is processed and reset afterwards
|
||||
using <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>Solaris Privileges</a>. Since the setting applies to the
|
||||
<em>process</em>, this is not compatible with threaded MPMs.</p>
|
||||
<p><var>Unix-userid</var> is one of:</p>
|
||||
<dl>
|
||||
<dt>A username</dt>
|
||||
<dd>Refers to the given user by name.</dd>
|
||||
|
||||
<dt><code>#</code> followed by a user number.</dt>
|
||||
<dd>Refers to a user by its number.</dd>
|
||||
</dl>
|
||||
|
||||
<note type="warning"><title>Security</title>
|
||||
<p>This directive cannot be used to run apache as root!
|
||||
Nevertheless, it opens potential security issues similar to
|
||||
those discussed in the <a href="../suexec.html">suexec</a>
|
||||
documentation.</p></note>
|
||||
</usage>
|
||||
<seealso><directive module="mod_unixd">User</directive></seealso>
|
||||
<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostGroup</name>
|
||||
<description>Sets the Group ID under which a virtual host runs.</description>
|
||||
<syntax>VHostGroup <var>unix-groupid</var></syntax>
|
||||
<default>Inherits the group id specified in
|
||||
<directive module="mod_unixd">Group</directive></default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
|
||||
|
||||
<usage>
|
||||
<p>The <directive>VHostGroup</directive> directive sets the Unix group
|
||||
under which the server will process requests to a virtualhost.
|
||||
The group is set before the request is processed and reset afterwards
|
||||
using <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>Solaris Privileges</a>. Since the setting applies to the
|
||||
<em>process</em>, this is not compatible with threaded MPMs.</p>
|
||||
<p><var>Unix-group</var> is one of:</p>
|
||||
<dl>
|
||||
<dt>A group name</dt>
|
||||
<dd>Refers to the given group by name.</dd>
|
||||
|
||||
<dt><code>#</code> followed by a group number.</dt>
|
||||
<dd>Refers to a group by its number.</dd>
|
||||
</dl>
|
||||
|
||||
<note type="warning"><title>Security</title>
|
||||
<p>This directive cannot be used to run apache as root!
|
||||
Nevertheless, it opens potential security issues similar to
|
||||
those discussed in the <a href="../suexec.html">suexec</a>
|
||||
documentation.</p></note>
|
||||
</usage>
|
||||
<seealso><directive module="mod_unixd">Group</directive></seealso>
|
||||
<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostSecure</name>
|
||||
<description>Determines whether the server runs with enhanced security
|
||||
for the virtualhost.</description>
|
||||
<syntax>VHostSecure On|Off</syntax>
|
||||
<default>VHostSecure On</default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
|
||||
|
||||
<usage>
|
||||
<p>Determines whether the virtual host processes requests with
|
||||
security enhanced by removal of <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>Privileges</a> that are rarely needed in a webserver, but which are
|
||||
available by default to a normal Unix user and may therefore
|
||||
be required by modules and applications. It is recommended that
|
||||
you retain the default (On) unless it prevents an application running.
|
||||
Since the setting applies to the <em>process</em>, this is not
|
||||
compatible with threaded MPMs.</p>
|
||||
<note><title>Note</title>
|
||||
<p>If <directive>VHostSecure</directive> prevents an application
|
||||
running, this may be a warning sign that the application should be
|
||||
reviewed for security.</p></note>
|
||||
</usage>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostCGIMode</name>
|
||||
<description>Determines whether the virtualhost can run
|
||||
subprocesses, and the privileges available to subprocesses.</description>
|
||||
<syntax>VHostCGIMode On|Off|Secure</syntax>
|
||||
<default>VHostCGIMode On</default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
|
||||
|
||||
<usage>
|
||||
<p>Determines whether the virtual host is allowed to run fork and exec,
|
||||
the <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>privileges</a> required to run subprocesses. If this is set to
|
||||
<var>Off</var> the virtualhost is denied the privileges and will not
|
||||
be able to run traditional CGI programs or scripts under the traditional
|
||||
<module>mod_cgi</module>, nor similar external programs such as those
|
||||
created by <module>mod_ext_filter</module> or
|
||||
<directive module="mod_rewrite">RewriteMap</directive> <var>prog</var>.
|
||||
Note that it does not prevent CGI programs running under alternative
|
||||
process and security models such as <a href="http://fastcgi.coremail.cn"
|
||||
>mod_fcgid</a>, which is a recommended solution in Solaris.</p>
|
||||
<p>If set to <var>On</var> or <var>Secure</var>, the virtual host
|
||||
is permitted to run external programs and scripts as above.
|
||||
Setting <directive>VHostCGIMode</directive> <var>Secure</var> has
|
||||
the effect of denying privileges to the subprocesses, as described
|
||||
for <directive>VHostSecure</directive>.</p>
|
||||
</usage>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>DTracePrivileges</name>
|
||||
<description>Determines whether the privileges required by dtrace are enabled.</description>
|
||||
<syntax>DTracePrivileges On|Off</syntax>
|
||||
<default>DTracePrivileges Off</default>
|
||||
<contextlist><context>server config</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
|
||||
|
||||
<usage>
|
||||
<p>This server-wide directive determines whether Apache will run with
|
||||
the <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>privileges</a> required to run
|
||||
<a href="http://www.sun.com/bigadmin/content/dtrace/">dtrace</a>.
|
||||
Note that <var>DTracePrivileges On</var> will not in itself
|
||||
activate DTrace, but <var>DTracePrivileges Off</var> will prevent
|
||||
it working.</p>
|
||||
</usage>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostPrivs</name>
|
||||
<description>Assign arbitrary privileges to a virtual host.</description>
|
||||
<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
|
||||
<default>None</default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM).
|
||||
and when <module>mod_privileges</module> is compiled with the
|
||||
<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>
|
||||
|
||||
<usage>
|
||||
<p><directive>VHostPrivs</directive> can be used to assign arbitrary <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>privileges</a> to a virtual host. Each <var>privilege-name</var>
|
||||
is the name of a Solaris privilege, such as <var>file_setid</var>
|
||||
or <var>sys_nfs</var>.</p>
|
||||
|
||||
<p>A <var>privilege-name</var> may optionally be prefixed by
|
||||
+ or -, which will respectively allow or deny a privilege.
|
||||
If used with neither + nor -, all privileges otherwise assigned
|
||||
to the virtualhost will be denied. You can use this to override
|
||||
any of the default sets and construct your own privilege set.</p>
|
||||
|
||||
<note type="warning"><title>Security</title>
|
||||
<p>This directive can open huge security holes in apache, up to
|
||||
and including running requests with root-level powers. Do not
|
||||
use it unless you fully understand what you are doing!</p></note>
|
||||
</usage>
|
||||
</directivesynopsis>
|
||||
|
||||
<directivesynopsis>
|
||||
<name>VHostCGIPrivs</name>
|
||||
<description>Assign arbitrary privileges to subprocesses created
|
||||
by a virtual host.</description>
|
||||
<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
|
||||
<default>None</default>
|
||||
<contextlist><context>virtual host</context></contextlist>
|
||||
<compatibility>Available on Solaris 10 and OpenSolaris with
|
||||
non-threaded MPMs (<module>prefork</module> or custom MPM)
|
||||
and when <module>mod_privileges</module> is compiled with the
|
||||
<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>
|
||||
|
||||
<usage>
|
||||
<p><directive>VHostCGIPrivs</directive> can be used to assign arbitrary <a
|
||||
href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
|
||||
>privileges</a> to subprocesses created by a virtual host, as discussed
|
||||
under <directive>VHostCGIMode</directive>. Each <var>privilege-name</var>
|
||||
is the name of a Solaris privilege, such as <var>file_setid</var>
|
||||
or <var>sys_nfs</var>.</p>
|
||||
|
||||
<p>A <var>privilege-name</var> may optionally be prefixed by
|
||||
+ or -, which will respectively allow or deny a privilege.
|
||||
If used with neither + nor -, all privileges otherwise assigned
|
||||
to the virtualhost will be denied. You can use this to override
|
||||
any of the default sets and construct your own privilege set.</p>
|
||||
|
||||
<note type="warning"><title>Security</title>
|
||||
<p>This directive can open huge security holes in apache subprocesses,
|
||||
up to and including running them with root-level powers. Do not
|
||||
use it unless you fully understand what you are doing!</p></note>
|
||||
</usage>
|
||||
</directivesynopsis>
|
||||
|
||||
|
||||
|
||||
</modulesynopsis>
|
||||
12
docs/manual/mod/mod_privileges.xml.meta
Normal file
12
docs/manual/mod/mod_privileges.xml.meta
Normal file
@ -0,0 +1,12 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!-- GENERATED FROM XML: DO NOT EDIT -->
|
||||
|
||||
<metafile>
|
||||
<basename>mod_privileges</basename>
|
||||
<path>/mod/</path>
|
||||
<relpath>..</relpath>
|
||||
|
||||
<variants>
|
||||
<variant>en</variant>
|
||||
</variants>
|
||||
</metafile>
|
||||
@ -10,6 +10,7 @@ else
|
||||
fi
|
||||
|
||||
APACHE_MODULE(unixd, unix specific support, , , $unixd_mods_enable)
|
||||
APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for Solaris)
|
||||
|
||||
APACHE_MODPATH_FINISH
|
||||
|
||||
|
||||
427
modules/arch/unix/mod_privileges.c
Normal file
427
modules/arch/unix/mod_privileges.c
Normal file
@ -0,0 +1,427 @@
|
||||
/* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
* contributor license agreements. See the NOTICE file distributed with
|
||||
* this work for additional information regarding copyright ownership.
|
||||
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
* (the "License"); you may not use this file except in compliance with
|
||||
* the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#include <priv.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include "httpd.h"
|
||||
#include "http_config.h"
|
||||
#include "http_protocol.h"
|
||||
#include "http_log.h"
|
||||
#include "mpm_common.h"
|
||||
#include "ap_mpm.h"
|
||||
#include "apr_strings.h"
|
||||
|
||||
/* TODO - get rid of unixd dependency */
|
||||
#include "unixd.h"
|
||||
|
||||
#define CFG_CHECK(x) if (x == -1) return strerror(errno);
|
||||
#define CR_CHECK(x) if (x == -1) \
|
||||
ap_log_error(APLOG_MARK, APLOG_CRIT,0,0, \
|
||||
"Failed to initialise privileges: %s", strerror(errno))
|
||||
|
||||
module AP_MODULE_DECLARE_DATA privileges_module;
|
||||
|
||||
/* #define BIG_SECURITY_HOLE 1 */
|
||||
|
||||
typedef struct {
|
||||
priv_set_t *priv;
|
||||
priv_set_t *child_priv;
|
||||
uid_t uid;
|
||||
gid_t gid;
|
||||
} priv_cfg;
|
||||
|
||||
static priv_set_t *priv_setid;
|
||||
static priv_set_t *priv_default = NULL;
|
||||
static int dtrace_enabled = 0;
|
||||
|
||||
static apr_status_t priv_cfg_cleanup(void *CFG)
|
||||
{
|
||||
priv_cfg *cfg = CFG;
|
||||
priv_freeset(cfg->priv);
|
||||
priv_freeset(cfg->child_priv);
|
||||
return APR_SUCCESS;
|
||||
}
|
||||
static void *privileges_create_cfg(apr_pool_t *pool, server_rec *s)
|
||||
{
|
||||
priv_cfg *cfg = apr_palloc(pool, sizeof(priv_cfg));
|
||||
|
||||
/* Start at basic privileges all round. */
|
||||
cfg->priv = priv_str_to_set("basic", ",", NULL);
|
||||
cfg->child_priv = priv_str_to_set("basic", ",", NULL);
|
||||
|
||||
/* By default, run in secure mode.
|
||||
* That means dropping basic privileges we don't usually need.
|
||||
*/
|
||||
CR_CHECK(priv_delset(cfg->priv, PRIV_FILE_LINK_ANY));
|
||||
CR_CHECK(priv_delset(cfg->priv, PRIV_PROC_INFO));
|
||||
CR_CHECK(priv_delset(cfg->priv, PRIV_PROC_SESSION));
|
||||
|
||||
/* Hmmm, should CGI default to secure too ? */
|
||||
/*
|
||||
CR_CHECK(priv_delset(cfg->child_priv, PRIV_FILE_LINK_ANY));
|
||||
CR_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_INFO));
|
||||
CR_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_SESSION));
|
||||
CR_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_FORK));
|
||||
CR_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_EXEC));
|
||||
*/
|
||||
|
||||
/* we´ll use 0 for unset */
|
||||
cfg->uid = 0;
|
||||
cfg->gid = 0;
|
||||
apr_pool_cleanup_register(pool, cfg, priv_cfg_cleanup,
|
||||
apr_pool_cleanup_null);
|
||||
|
||||
/* top-level default_priv wants the top-level cfg */
|
||||
if (priv_default == NULL) {
|
||||
priv_default = cfg->priv;
|
||||
}
|
||||
return cfg;
|
||||
}
|
||||
|
||||
static apr_status_t privileges_end_req(void *data)
|
||||
{
|
||||
request_rec *r = data;
|
||||
priv_cfg *cfg = ap_get_module_config(r->server->module_config,
|
||||
&privileges_module);
|
||||
|
||||
/* ugly hack: grab default uid and gid from unixd */
|
||||
extern unixd_config_rec unixd_config;
|
||||
|
||||
/* if either user or group are not the default, restore them */
|
||||
if (cfg->uid || cfg->gid) {
|
||||
if (setppriv(PRIV_ON, PRIV_EFFECTIVE, priv_setid) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"PRIV_ON failed restoring default user/group");
|
||||
}
|
||||
if (cfg->uid && (setuid(unixd_config.user_id) == -1)) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error restoring default userid");
|
||||
}
|
||||
if (cfg->gid && (setgid(unixd_config.group_id) == -1)) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error restoring default group");
|
||||
}
|
||||
}
|
||||
|
||||
/* restore default privileges */
|
||||
if (setppriv(PRIV_SET, PRIV_EFFECTIVE, priv_default) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error restoring default privileges: %s");
|
||||
}
|
||||
return APR_SUCCESS;
|
||||
}
|
||||
static int privileges_req(request_rec *r)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(r->server->module_config,
|
||||
&privileges_module);
|
||||
|
||||
/* cleanup should happen even if something fails part-way through here */
|
||||
apr_pool_cleanup_register(r->pool, r, privileges_end_req,
|
||||
apr_pool_cleanup_null);
|
||||
|
||||
/* set user and group if configured */
|
||||
if (cfg->uid || cfg->gid) {
|
||||
if (setppriv(PRIV_ON, PRIV_EFFECTIVE, priv_setid) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"No privilege to set user/group");
|
||||
}
|
||||
/* if we should be able to set these but can't, it could be
|
||||
* a serious security issue. Bail out rather than risk it!
|
||||
*/
|
||||
if (cfg->uid && (setuid(cfg->uid) == -1)) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error setting userid");
|
||||
return HTTP_INTERNAL_SERVER_ERROR;
|
||||
}
|
||||
if (cfg->gid && (setgid(cfg->gid) == -1)) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error setting group");
|
||||
return HTTP_INTERNAL_SERVER_ERROR;
|
||||
}
|
||||
}
|
||||
/* set vhost's privileges */
|
||||
if (setppriv(PRIV_SET, PRIV_EFFECTIVE, cfg->priv) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error setting effective privileges: %s");
|
||||
return HTTP_INTERNAL_SERVER_ERROR;
|
||||
}
|
||||
|
||||
/* ... including those of any subprocesses */
|
||||
if (setppriv(PRIV_SET, PRIV_INHERITABLE, cfg->child_priv) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error setting inheritable privileges: %s");
|
||||
return HTTP_INTERNAL_SERVER_ERROR;
|
||||
}
|
||||
if (setppriv(PRIV_SET, PRIV_LIMIT, cfg->child_priv) == -1) {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
||||
"Error setting limit privileges: %s");
|
||||
return HTTP_INTERNAL_SERVER_ERROR;
|
||||
}
|
||||
|
||||
return OK;
|
||||
}
|
||||
#define PDROP_CHECK(x) if (x == -1) { \
|
||||
ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, \
|
||||
"Error dropping privileges: %s", strerror(errno)); \
|
||||
return !OK; \
|
||||
}
|
||||
|
||||
static int privileges_drop_first(apr_pool_t *pool, server_rec *s)
|
||||
{
|
||||
/* We need to set privileges before mod_unixd,
|
||||
* 'cos otherwise setuid will wipe our privilege to do so
|
||||
*/
|
||||
priv_cfg *spcfg;
|
||||
server_rec *sp;
|
||||
priv_set_t *ppriv = priv_allocset();
|
||||
|
||||
/* compute ppriv from the union of all the vhosts plus setid */
|
||||
priv_copyset(priv_setid, ppriv);
|
||||
for (sp = s; sp != NULL; sp=sp->next) {
|
||||
spcfg = ap_get_module_config(sp->module_config, &privileges_module);
|
||||
priv_union(spcfg->priv, ppriv);
|
||||
}
|
||||
PDROP_CHECK(setppriv(PRIV_SET, PRIV_PERMITTED, ppriv))
|
||||
PDROP_CHECK(setppriv(PRIV_SET, PRIV_EFFECTIVE, ppriv))
|
||||
priv_freeset(ppriv);
|
||||
|
||||
return OK;
|
||||
}
|
||||
static int privileges_drop_last(apr_pool_t *pool, server_rec *s)
|
||||
{
|
||||
/* Our config stuff has set the privileges we need, so now
|
||||
* we just set them to those of the parent server_rec
|
||||
*
|
||||
* This has to happen after mod_unixd, 'cos mod_unixd needs
|
||||
* privileges we drop here.
|
||||
*/
|
||||
priv_cfg *cfg = ap_get_module_config(s->module_config, &privileges_module);
|
||||
|
||||
/* defaults - the default vhost */
|
||||
PDROP_CHECK(setppriv(PRIV_SET, PRIV_LIMIT, cfg->child_priv))
|
||||
PDROP_CHECK(setppriv(PRIV_SET, PRIV_INHERITABLE, cfg->child_priv))
|
||||
PDROP_CHECK(setppriv(PRIV_SET, PRIV_EFFECTIVE, cfg->priv))
|
||||
|
||||
return OK;
|
||||
}
|
||||
static apr_status_t privileges_term(void *rec)
|
||||
{
|
||||
priv_freeset(priv_setid);
|
||||
return APR_SUCCESS;
|
||||
}
|
||||
static int privileges_postconf(apr_pool_t *pconf, apr_pool_t *plog,
|
||||
apr_pool_t *ptemp, server_rec *s)
|
||||
{
|
||||
priv_cfg *cfg;
|
||||
server_rec *sp;
|
||||
|
||||
/* if we have dtrace enabled, merge it into everything */
|
||||
if (dtrace_enabled) {
|
||||
for (sp = s; sp != NULL; sp = sp->next) {
|
||||
cfg = ap_get_module_config(sp->module_config, &privileges_module);
|
||||
CR_CHECK(priv_addset(cfg->priv, PRIV_DTRACE_KERNEL));
|
||||
CR_CHECK(priv_addset(cfg->priv, PRIV_DTRACE_PROC));
|
||||
CR_CHECK(priv_addset(cfg->priv, PRIV_DTRACE_USER));
|
||||
CR_CHECK(priv_addset(cfg->child_priv, PRIV_DTRACE_KERNEL));
|
||||
CR_CHECK(priv_addset(cfg->child_priv, PRIV_DTRACE_PROC));
|
||||
CR_CHECK(priv_addset(cfg->child_priv, PRIV_DTRACE_USER));
|
||||
}
|
||||
CR_CHECK(priv_addset(priv_default, PRIV_DTRACE_KERNEL));
|
||||
CR_CHECK(priv_addset(priv_default, PRIV_DTRACE_PROC));
|
||||
CR_CHECK(priv_addset(priv_default, PRIV_DTRACE_USER));
|
||||
}
|
||||
|
||||
/* set up priv_setid for per-request use */
|
||||
priv_setid = priv_allocset();
|
||||
apr_pool_cleanup_register(pconf, NULL, privileges_term,
|
||||
apr_pool_cleanup_null);
|
||||
priv_emptyset(priv_setid);
|
||||
if (priv_addset(priv_setid, PRIV_PROC_SETID) == -1) {
|
||||
ap_log_perror(APLOG_MARK, APLOG_CRIT, 0, ptemp,
|
||||
"priv_addset: ", strerror(errno));
|
||||
return !OK;
|
||||
}
|
||||
return OK;
|
||||
}
|
||||
static int privileges_init(apr_pool_t *pconf, apr_pool_t *plog,
|
||||
apr_pool_t *ptemp)
|
||||
{
|
||||
/* refuse to work if the MPM is threaded */
|
||||
int threaded;
|
||||
int rv = ap_mpm_query(AP_MPMQ_IS_THREADED, &threaded);
|
||||
if (rv != APR_SUCCESS) {
|
||||
ap_log_perror(APLOG_MARK, APLOG_NOTICE, rv, ptemp,
|
||||
"mod_privileges: unable to determine MPM characteristics."
|
||||
" Please ensure you are using a non-threaded MPM "
|
||||
"with this module.");
|
||||
}
|
||||
if (threaded) {
|
||||
ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, ptemp,
|
||||
"mod_privileges is not compatible with a threaded MPM.");
|
||||
return !OK;
|
||||
}
|
||||
return OK;
|
||||
}
|
||||
static void privileges_hooks(apr_pool_t *pool)
|
||||
{
|
||||
ap_hook_post_read_request(privileges_req, NULL, NULL,
|
||||
APR_HOOK_REALLY_FIRST);
|
||||
ap_hook_drop_privileges(privileges_drop_first, NULL, NULL, APR_HOOK_FIRST);
|
||||
ap_hook_drop_privileges(privileges_drop_last, NULL, NULL, APR_HOOK_LAST);
|
||||
ap_hook_post_config(privileges_postconf, NULL, NULL, APR_HOOK_MIDDLE);
|
||||
ap_hook_pre_config(privileges_init, NULL, NULL, APR_HOOK_FIRST);
|
||||
}
|
||||
|
||||
static const char *vhost_user(cmd_parms *cmd, void *dir, const char *arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
cfg->uid = ap_uname2id(arg);
|
||||
if (cfg->uid == 0) {
|
||||
return apr_pstrcat(cmd->pool, "Invalid userid for VHostUser: ",
|
||||
arg, NULL);
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
static const char *vhost_group(cmd_parms *cmd, void *dir, const char *arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
cfg->gid = ap_gname2id(arg);
|
||||
if (cfg->uid == 0) {
|
||||
return apr_pstrcat(cmd->pool, "Invalid groupid for VHostGroup: ",
|
||||
arg, NULL);
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
static const char *vhost_secure(cmd_parms *cmd, void *dir, int arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
if (!arg) {
|
||||
/* add basic privileges, excluding those covered by cgimode */
|
||||
CFG_CHECK(priv_addset(cfg->priv, PRIV_FILE_LINK_ANY));
|
||||
CFG_CHECK(priv_addset(cfg->priv, PRIV_PROC_INFO));
|
||||
CFG_CHECK(priv_addset(cfg->priv, PRIV_PROC_SESSION));
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
static const char *vhost_cgimode(cmd_parms *cmd, void *dir, const char *arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
if (!strcasecmp(arg, "on")) {
|
||||
/* default - nothing to do */
|
||||
}
|
||||
else if (!strcasecmp(arg, "off")) {
|
||||
/* drop fork+exec privs */
|
||||
CFG_CHECK(priv_delset(cfg->priv, PRIV_PROC_FORK));
|
||||
CFG_CHECK(priv_delset(cfg->priv, PRIV_PROC_EXEC));
|
||||
}
|
||||
else if (!strcasecmp(arg, "secure")) {
|
||||
/* deny privileges to CGI procs */
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_FORK));
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_EXEC));
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, PRIV_FILE_LINK_ANY));
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_INFO));
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, PRIV_PROC_SESSION));
|
||||
}
|
||||
else {
|
||||
return "VHostCGIMode must be On, Off or Secure";
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
static const char *dtraceenable(cmd_parms *cmd, void *dir, int arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
|
||||
if (err != NULL) {
|
||||
return err;
|
||||
}
|
||||
dtrace_enabled = arg;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
#ifdef BIG_SECURITY_HOLE
|
||||
static const char *vhost_privs(cmd_parms *cmd, void *dir, const char *arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
const char *priv = arg;
|
||||
|
||||
if (*priv == '-') {
|
||||
CFG_CHECK(priv_delset(cfg->priv, priv+1));
|
||||
}
|
||||
else if (*priv == '+') {
|
||||
CFG_CHECK(priv_addset(cfg->priv, priv+1));
|
||||
}
|
||||
else {
|
||||
priv_emptyset(cfg->priv);
|
||||
CFG_CHECK(priv_addset(cfg->priv, priv));
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
static const char *vhost_cgiprivs(cmd_parms *cmd, void *dir, const char *arg)
|
||||
{
|
||||
priv_cfg *cfg = ap_get_module_config(cmd->server->module_config,
|
||||
&privileges_module);
|
||||
const char *priv = arg;
|
||||
if (*priv == '-') {
|
||||
CFG_CHECK(priv_delset(cfg->child_priv, priv+1));
|
||||
}
|
||||
else if (*priv == '+') {
|
||||
CFG_CHECK(priv_addset(cfg->child_priv, priv+1));
|
||||
}
|
||||
else {
|
||||
priv_emptyset(cfg->child_priv);
|
||||
CFG_CHECK(priv_addset(cfg->child_priv, priv));
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
|
||||
static const command_rec privileges_cmds[] = {
|
||||
AP_INIT_TAKE1("VHostUser", vhost_user, NULL, RSRC_CONF,
|
||||
"Userid under which the virtualhost will run"),
|
||||
AP_INIT_TAKE1("VHostGroup", vhost_group, NULL, RSRC_CONF,
|
||||
"Group under which the virtualhost will run"),
|
||||
AP_INIT_FLAG("VHostSecure", vhost_secure, NULL, RSRC_CONF,
|
||||
"Run in secure mode (default ON)"),
|
||||
AP_INIT_TAKE1("VHostCGIMode", vhost_cgimode, NULL, RSRC_CONF,
|
||||
"Enable fork+exec for this virtualhost (Off|Secure|On)"),
|
||||
AP_INIT_FLAG("DTracePrivileges", dtraceenable, NULL, RSRC_CONF,
|
||||
"Enable DTrace"),
|
||||
#ifdef BIG_SECURITY_HOLE
|
||||
AP_INIT_ITERATE("VHostPrivs", vhost_privs, NULL, RSRC_CONF,
|
||||
"Privileges available in the (virtual) server"),
|
||||
AP_INIT_ITERATE("VHostCGIPrivs", vhost_cgiprivs, NULL, RSRC_CONF,
|
||||
"Privileges available to external programs"),
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
module AP_MODULE_DECLARE_DATA privileges_module = {
|
||||
STANDARD20_MODULE_STUFF,
|
||||
NULL,
|
||||
NULL,
|
||||
privileges_create_cfg,
|
||||
NULL,
|
||||
privileges_cmds,
|
||||
privileges_hooks
|
||||
};
|
||||
Reference in New Issue
Block a user