[PATCH] mod_jk - chroot and user issues

[Kurt Miller <tr...@optonline.net>]

I recently created a port of mod_jk-1.2.1 for OpenBSD and needed to make
some minor patches to mod_jk. OpenBSD 3.2 has Apache 1.3.26 configured as
ServerType standalone, to chroot to /var/www and run as user www by default.
This combination requires a few minor patches so that mod_jk will continue
to work after an Apache restart.

Both jk_set_worker_file and jk_set_log_file need to call
ap_server_strip_chroot to account for the path changes while chrooted.

The log file is initially created as user/group = root/daemon, but after a
restart Apache is running as www/www so it doesn't have permission to reopen
the log file. In order to have the log file continue working after a
restart, I patched jk_init. Instead of setting conf->log to NULL when
jk_open_file_logger fails, I set it to main_log. In other words, if the new
log file can't be opened it falls back to the already open one. Other
possible solutions are to change the user and/or group of the log file to
match the Apache User/Group directives, however if the admin changes the log
file name the open will still fail unless the directory has write access for
the Apache User/Group.

I made some Makefile.in patches to allow the object files to be built
outside the source tree. I think these patches will work for other archs/OSs
too.

Please review and consider commiting. Please cc me if replying. Thank You.

-Kurt

Re: [PATCH] mod_jk - chroot and user issues

[Henri Gomez <hg...@apache.org>]

Kurt Miller wrote:
> I recently created a port of mod_jk-1.2.1 for OpenBSD and needed to make
> some minor patches to mod_jk. OpenBSD 3.2 has Apache 1.3.26 configured as
> ServerType standalone, to chroot to /var/www and run as user www by default.
> This combination requires a few minor patches so that mod_jk will continue
> to work after an Apache restart.

I'm fine with the makefile updates but there is a problem with change in
apache-1.3/mod_jk.c since there is no ap_server_strip_chroot call
available on my Linux box.

Is it an OpenBSD specific call ?

If so we'll have to add some #ifdef OPEN_BSD and I'd like to
have others jk commiters opinion. (I allready put too much
#ifdef AS400 ;)

I'll be to use a #ifdef CHROOTED_APACHE :

--- apache-1.3/mod_jk.c.orig	Tue Nov 26 12:26:25 2002
+++ apache-1.3/mod_jk.c	Mon Dec  9 01:59:18 2002
...

      /* we need an absolut path */
      conf->worker_file = ap_server_root_relative(cmd->pool,worker_file);
#ifdef CHROOTED_APACHE
      ap_server_strip_chroot(conf->worker_file,0);
#endif

      if (conf->worker_file == worker_file)
          conf->worker_file = ap_pstrdup(cmd->pool,worker_file);

....


      /* we need an absolut path */
      conf->log_file = ap_server_root_relative(cmd->pool,log_file);
#ifdef CHROOTED_APACHE
      ap_server_strip_chroot(conf->log_file,0);
#endif

      if ( conf->log_file == log_file)
          conf->log_file = ap_pstrdup(cmd->pool,log_file);

....

@@ -1742,7 +1746,7 @@ static void jk_init(server_rec *s, ap_po
      /* Open up log file */
      if(conf->log_file && conf->log_level >= 0) {
          if(!jk_open_file_logger(&(conf->log), conf->log_file, 
conf->log_level)) {
#ifdef CHROOTED_APACHE
             conf->log = main_log;
#else
              conf->log = NULL;
#endif
          } else {
              main_log = conf->log;
          }



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>