Attachment #12508 for bug #21839

View | Details | Raw Unified | Return to bug 21839
Collapse All | Expand All




  APACHE_SUBST(HTTPD_LDFLAGS)
  APACHE_SUBST(UTIL_LDFLAGS)
  APACHE_SUBST(LIBS)
  APACHE_SUBST(SSL_LIBS)
  APACHE_SUBST(DEFS)
  APACHE_SUBST(INCLUDES)
  APACHE_SUBST(NOTEST_CPPFLAGS)

])dnl

dnl
dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config[, libs]]]]])
dnl
dnl default is one of:
dnl   yes    -- enabled by default. user must explicitly disable.

      fi
      shared="";;
    esac
    APACHE_MODPATH_ADD($1, $shared, $3,, $7)
  fi
])dnl


      APR_ADDTO(LDFLAGS, [$ap_platform_runtime_link_flag$ap_ssltk_libdir])
    fi
  fi
  APR_ADDTO(SSL_LIBS, [-lssl -lcrypto])
  ap_cv_ssltk="$ap_ssltk_base"
fi
])




.el .ne 3
.IP "\\$1" \\$2
..
.TH "SUEXEC2" 8 "2003-04-29" "Apache HTTP Server" "suexec"

.SH NAME
suexec \- Switch user before executing external programs

.SH "SYNOPSIS"
 
.PP
\fBsuexec2\fR -\fBV\fR
 

.SH "SUMMARY"
 
.PP
suexec2 is used by the Apache HTTP Server to switch to another user before executing CGI programs\&. In order to achieve this, it must run as root\&. Since the HTTP daemon normally doesn't run as root, the suexec executable needs the setuid bit set and must be owned by root\&. It should never be writable for any other person than root\&.
 
.PP
For further information about the concepts and and the security model of suexec2 please refer to the suexec documentation (http://httpd\&.apache\&.org/docs-2\&.0/suexec\&.html)\&.
 

.SH "OPTIONS"

 
.TP
-V
If you are root, this option displays the compile options of suexec2\&. For security reasons all configuration options are changable only at compile time\&.  
.RE
 

Lines 79-85 Link Here

(-)httpd-2.0.46.orig/modules/ssl/config.m4 (-1 / +1 lines)
79	APACHE_CHECK_SSL_TOOLKIT	79	APACHE_CHECK_SSL_TOOLKIT
80	AC_CHECK_FUNCS(SSL_set_state)	80	AC_CHECK_FUNCS(SSL_set_state)
81	AC_CHECK_FUNCS(SSL_set_cert_store)	81	AC_CHECK_FUNCS(SSL_set_cert_store)
82	])	82	], [\$(SSL_LIBS)])
83		83
84	dnl # end of module specific part	84	dnl # end of module specific part
85	APACHE_MODPATH_FINISH	85	APACHE_MODPATH_FINISH





AP_DECLARE(void) unixd_pre_config(apr_pool_t *ptemp)
{
    struct stat wrapper;

    unixd_config.user_name = DEFAULT_USER;
    unixd_config.user_id = ap_uname2id(DEFAULT_USER);
    unixd_config.group_id = ap_gname2id(DEFAULT_GROUP);

    /* Check for suexec */
    if (stat(SUEXEC_BIN, &wrapper) == 0 && 
	(wrapper.st_mode & S_ISUID) && wrapper.st_uid == 0) {
                  APR_FINFO_NORM, ptemp)) != APR_SUCCESS) {
        return;
    }

    /* XXX - apr_stat is incapable of checking suid bits (grumble) */
    /* if ((wrapper.filetype & S_ISUID) && wrapper.user == 0) { */
        unixd_config.suexec_enabled = 1;
    } else {
	unixd_config.suexec_enabled = 0;
    }
    
}



Lines 28-34 Link Here

(-)httpd-2.0.46.orig/support/apachectl.in (-1 / +2 lines)
28	# -------------------- --------------------	28	# -------------------- --------------------
29	#	29	#
30	# the path to your httpd binary, including options if necessary	30	# the path to your httpd binary, including options if necessary
31	HTTPD='@exp_sbindir@/@progname@'	31	. /etc/conf.d/apache2
		32	HTTPD="@exp_sbindir@/@progname@ ${APACHE2_OPTS}"
32	#	33	#
33	# pick up any necessary environment variables	34	# pick up any necessary environment variables
34	if test -f @exp_bindir@/envvars; then	35	if test -f @exp_bindir@/envvars; then




    ($httpd = $0) =~ s:support/apxs$::;
}

unless (-x "$httpd") {
	error("$httpd not found or not executable");
	exit 1;
}

unless (grep /mod_so/, `. $envvars && $httpd -l`) {
    error("Sorry, no shared object support for Apache");
    error("available under your platform. Make sure");
    error("the Apache module mod_so is compiled into");
    error("your server binary `$httpd'.");
    exit 1;
}

sub get_config_vars{
    my ($file, $rh_config) = @_;


Return to bug 21839

Lines 60-65 Link Here

(-)httpd-2.0.46.orig/acinclude.m4 (-3 / +4 lines)
60	APACHE_SUBST(HTTPD_LDFLAGS)	60	APACHE_SUBST(HTTPD_LDFLAGS)
61	APACHE_SUBST(UTIL_LDFLAGS)	61	APACHE_SUBST(UTIL_LDFLAGS)
62	APACHE_SUBST(LIBS)	62	APACHE_SUBST(LIBS)
		63	APACHE_SUBST(SSL_LIBS)
63	APACHE_SUBST(DEFS)	64	APACHE_SUBST(DEFS)
64	APACHE_SUBST(INCLUDES)	65	APACHE_SUBST(INCLUDES)
65	APACHE_SUBST(NOTEST_CPPFLAGS)	66	APACHE_SUBST(NOTEST_CPPFLAGS)
Lines 190-196 Link Here
190	])dnl	191	])dnl
191		192
192	dnl	193	dnl
193	dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])	194	dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config[, libs]]]]])
194	dnl	195	dnl
195	dnl default is one of:	196	dnl default is one of:
196	dnl yes -- enabled by default. user must explicitly disable.	197	dnl yes -- enabled by default. user must explicitly disable.
Lines 266-272 Link Here
266	fi	267	fi
267	shared="";;	268	shared="";;
268	esac	269	esac
269	APACHE_MODPATH_ADD($1, $shared, $3)	270	APACHE_MODPATH_ADD($1, $shared, $3,, $7)
270	fi	271	fi
271	])dnl	272	])dnl
272		273
Lines 488-494 Link Here
488	APR_ADDTO(LDFLAGS, [$ap_platform_runtime_link_flag$ap_ssltk_libdir])	489	APR_ADDTO(LDFLAGS, [$ap_platform_runtime_link_flag$ap_ssltk_libdir])
489	fi	490	fi
490	fi	491	fi
491	APR_ADDTO(LIBS, [-lssl -lcrypto])	492	APR_ADDTO(SSL_LIBS, [-lssl -lcrypto])
492	ap_cv_ssltk="$ap_ssltk_base"	493	ap_cv_ssltk="$ap_ssltk_base"
493	fi	494	fi
494	])	495	])

Lines 243-265 Link Here

(-)httpd-2.0.46.orig/os/unix/unixd.c (-10 / +7 lines)
243		243
244	AP_DECLARE(void) unixd_pre_config(apr_pool_t *ptemp)	244	AP_DECLARE(void) unixd_pre_config(apr_pool_t *ptemp)
245	{	245	{
246	apr_finfo_t wrapper;	246	struct stat wrapper;
247		247
248	unixd_config.user_name = DEFAULT_USER;	248	unixd_config.user_name = DEFAULT_USER;
249	unixd_config.user_id = ap_uname2id(DEFAULT_USER);	249	unixd_config.user_id = ap_uname2id(DEFAULT_USER);
250	unixd_config.group_id = ap_gname2id(DEFAULT_GROUP);	250	unixd_config.group_id = ap_gname2id(DEFAULT_GROUP);
251		251
252	/* Check for suexec */	252	/* Check for suexec */
253	unixd_config.suexec_enabled = 0;	253	if (stat(SUEXEC_BIN, &wrapper) == 0 &&
254	if ((apr_stat(&wrapper, SUEXEC_BIN,	254	(wrapper.st_mode & S_ISUID) && wrapper.st_uid == 0) {
255	APR_FINFO_NORM, ptemp)) != APR_SUCCESS) {
256	return;
257	}
258
259	/* XXX - apr_stat is incapable of checking suid bits (grumble) */
260	/* if ((wrapper.filetype & S_ISUID) && wrapper.user == 0) { */
261	unixd_config.suexec_enabled = 1;	255	unixd_config.suexec_enabled = 1;
262	/* } */	256	} else {
		257	unixd_config.suexec_enabled = 0;
		258	}
		259
263	}	260	}
264		261
265		262

Lines 237-255 Link Here

(-)httpd-2.0.46.orig/support/apxs.in (-13 lines)
237	($httpd = $0) =~ s:support/apxs$::;	237	($httpd = $0) =~ s:support/apxs$::;
238	}	238	}
239		239
240	unless (-x "$httpd") {
241	error("$httpd not found or not executable");
242	exit 1;
243	}
244
245	unless (grep /mod_so/, `. $envvars && $httpd -l`) {
246	error("Sorry, no shared object support for Apache");
247	error("available under your platform. Make sure");
248	error("the Apache module mod_so is compiled into");
249	error("your server binary `$httpd'.");
250	exit 1;
251	}
252
253	sub get_config_vars{	240	sub get_config_vars{
254	my ($file, $rh_config) = @_;	241	my ($file, $rh_config) = @_;
255		242

Lines 19-25 Link Here

(-)httpd-2.0.46.orig/docs/man/suexec.8 (-5 / +5 lines)
19	.el .ne 3	19	.el .ne 3
20	.IP "\\$1" \\$2	20	.IP "\\$1" \\$2
21	..	21	..
22	.TH "SUEXEC" 8 "2003-04-29" "Apache HTTP Server" "suexec"	22	.TH "SUEXEC2" 8 "2003-04-29" "Apache HTTP Server" "suexec"
23		23
24	.SH NAME	24	.SH NAME
25	suexec \- Switch user before executing external programs	25	suexec \- Switch user before executing external programs
Lines 27-42 Link Here
27	.SH "SYNOPSIS"	27	.SH "SYNOPSIS"
28		28
29	.PP	29	.PP
30	\fBsuexec\fR -\fBV\fR	30	\fBsuexec2\fR -\fBV\fR
31		31
32		32
33	.SH "SUMMARY"	33	.SH "SUMMARY"
34		34
35	.PP	35	.PP
36	suexec is used by the Apache HTTP Server to switch to another user before executing CGI programs\&. In order to achieve this, it must run as root\&. Since the HTTP daemon normally doesn't run as root, the suexec executable needs the setuid bit set and must be owned by root\&. It should never be writable for any other person than root\&.	36	suexec2 is used by the Apache HTTP Server to switch to another user before executing CGI programs\&. In order to achieve this, it must run as root\&. Since the HTTP daemon normally doesn't run as root, the suexec executable needs the setuid bit set and must be owned by root\&. It should never be writable for any other person than root\&.
37		37
38	.PP	38	.PP
39	For further information about the concepts and and the security model of suexec please refer to the suexec documentation (http://httpd\&.apache\&.org/docs-2\&.0/suexec\&.html)\&.	39	For further information about the concepts and and the security model of suexec2 please refer to the suexec documentation (http://httpd\&.apache\&.org/docs-2\&.0/suexec\&.html)\&.
40		40
41		41
42	.SH "OPTIONS"	42	.SH "OPTIONS"
Lines 45-50 Link Here
45		45
46	.TP	46	.TP
47	-V	47	-V
48	If you are root, this option displays the compile options of suexec\&. For security reasons all configuration options are changable only at compile time\&.	48	If you are root, this option displays the compile options of suexec2\&. For security reasons all configuration options are changable only at compile time\&.
49	.RE	49	.RE
50		50