4 ms·
The parent process continues to run as root.
by netsec_burn 8y ago
The parent process continues to run as root.
- vbezhenar 8y agoWhy is it necessary?
- mjw1007 8y agoThe usual reason for this sort of design is so you can support loading a new configuration without having to restart the whole thing, if the new config might need you to do additional things that require privilege (maybe bind to new low ports, or read key files).
- vbezhenar 8y agoI would expect restart to bind to new ports. It's not something that should be supported on-the fly (it's good thing, of course, but not at expense of keeping root process). Reloading key files is useful, but I think that it could be implemented with other means (e.g. reload program which runs under root, could read those files and pass them via some kind of IPC).
- dspillett 8y agoBecause, depending on your configured concurrency model, it may need to be able to spawn new processes/threads as other users, and this is not possible unless you have at least one process running with some privileges beyond that of the normal users. This usually means root. Even if not root, it needs to be a user/group privileged enough to be able to impersonate the other users, or it can't do its job. The code running with greater privilege is kept to a minimum but at least some needs to be there, and this exploit potentially gives a route through to manipulate it. FastCGI and similar can help here - it can push the creation of user specific processes away from Apache, making it harder to cross the barrier.
- merb 8y agoyou can't bind to port 80/443 without being root unless you have cap_net_bind_service. so instead of using nat/caps you just spawn as root to bind.
- kelnos 8y agoRight, but there's no reason for the parent process to keep root privileges after binding to the privileged ports.
- vbezhenar 8y agoThanks. I never used that feature, nor I ever heard of anyone using it. IMO there should be some configuration option to turn that feature off, which will allow to run all processes as a designated user. Or, if those users could be enumerated at startup, it could spawn one process for each user.