Bug 600292 – >=www-servers/apache-2.4.23-r1: systemd hardening breaks suexec

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Russell Yanofsky 2016-11-20 14:30:14 UTC]

The "NoNewPrivileges=true" line added to /usr/lib/systemd/system/apache2.service causes internal server errors on suexec pages. There are also setgid errors like the following in /var/log/apache2/suexec_log:

[2016-11-20 14:02:42]: uid: (65000/wces) gid: (65000/wces) cmd: php
[2016-11-20 14:02:42]: failed to setgid (65000: php)

I think it would be good to have a warning in the ebuild about incompatibility with systemd when the suexec USE flag is enabled.

I also think it would be good to add a comment to the apache2.service file mentioning that the NoNewPrivileges=true line is incompatible with suexec.

(See also bug 586984 which added hardening and bug 595086 which reported a similar PHP breakage.)

[Comment 1 Timo Rothenpieler 2018-03-23 13:34:11 UTC]

I ran into the exact same thing yesterday, it's still an issue even with latest apache 2.4.

Adding an override.conf with NoNewPrivileges=false makes suexec work.

Maybe the systemd unit should be sed-patched when suexec is enabled?

[Comment 2 Pacho Ramos 2021-02-12 09:20:00 UTC]

*** Bug 750470 has been marked as a duplicate of this bug. ***

[Comment 3 Pacho Ramos 2021-02-12 14:28:35 UTC]

The only hardening option set in Fedora is 
PrivateTmp=true

https://src.fedoraproject.org/rpms/httpd/blob/rawhide/f/httpd%40.service

I would then simply drop all the other extra hardening to prevent problems like this.

[Comment 4 Nick Wiltshire 2021-09-12 03:43:26 UTC]

I know systemd is low priority, but given the relative simplicity of this change and the fact that it's almost 5 years old, can we get a fix? It's annoying having Apache break on every upgrade.

[Comment 5 Nick Wiltshire 2021-11-10 21:01:45 UTC]

Still exists in apache-2.4.51.

In the ebuild exists this line:
systemd_newunit "${FILESDIR}/apache2.2-hardened.service" "apache2.service"

Perhaps we shouldn't be using the hardened file unless the hardened flag is set?

Either way a simple search and replace fixes it. Apache breaking on every upgrade is ridiculous.

[Comment 6 Pacho Ramos 2021-11-11 10:13:52 UTC]

(In reply to Pacho Ramos from comment #3)
> The only hardening option set in Fedora is 
> PrivateTmp=true
> 
> https://src.fedoraproject.org/rpms/httpd/blob/rawhide/f/httpd%40.service
> 
> I would then simply drop all the other extra hardening to prevent problems
> like this.

I would do this by default following Fedora/RHEL (that is one of the most tested setups too with apache+systemd)

For the extra hardening, I don't care about putting it behind a USE flag...

[Comment 7 Nick Wiltshire 2022-04-19 18:55:33 UTC]

Created attachment 771944 [details, diff]
Patch to fix systemd unit file

Still present in 2.4.53. Attaching a patch.

[Comment 8 Nick Wiltshire 2022-07-25 17:03:50 UTC]

Still present in 2.4.54-r2

Previously attached patch still valid.

[Comment 9 Larry the Git Cow 2022-07-27 09:43:25 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3719c65ae2577477396fb27c5e42847f1c70ca45

commit 3719c65ae2577477396fb27c5e42847f1c70ca45
Author:     Hans de Graaff <[e-mail]>
AuthorDate: 2022-07-27 09:40:40 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2022-07-27 09:43:20 +0000

    www-servers/apache: fix systemd file
    
    Drop the duplicate PrivateTmp setting and remove the
    NoNewPrivileges=true setting since it causes issues with suexec and
    other distributions don't use this as part of their hardened
    configuration.
    
    Thanks to Nick Wiltshire for that patch that this is based on.
    
    Closes: https://bugs.gentoo.org/600292
    Signed-off-by: Hans de Graaff <[e-mail]>

 www-servers/apache/apache-2.4.54-r6.ebuild         | 259 +++++++++++++++++++++
 .../apache/files/apache2.4-hardened.service        |  25 ++
 2 files changed, 284 insertions(+)