You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by jo...@apache.org on 2012/05/23 17:42:33 UTC
svn commit: r1341905 - in /httpd/httpd/trunk: CHANGES configure.in
support/suexec.c
Author: jorton
Date: Wed May 23 15:42:33 2012
New Revision: 1341905
URL: http://svn.apache.org/viewvc?rev=1341905&view=rev
Log:
suexec: Add support for logging to syslog as an alternative to a
logfile.
* support/suexec.c (err_output) [AP_LOG_SYSLOG]: Log to syslog.
(main): Close syslog fd if open, before execv. Add -V output
for AP_LOG_SYSLOG.
* configure.in: Add --with-suexec-syslog argument; allow
--without-suexec-logfile to omit definition of AP_LOG_EXEC.
Modified:
httpd/httpd/trunk/CHANGES
httpd/httpd/trunk/configure.in
httpd/httpd/trunk/support/suexec.c
Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1341905&r1=1341904&r2=1341905&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Wed May 23 15:42:33 2012
@@ -1,6 +1,10 @@
-*- coding: utf-8 -*-
Changes with Apache 2.5.0
+ *) suexec: Add support for logging to syslog as an alternative to
+ logging to a file; use --without-suexec-logfile --with-suexec-syslog.
+ [Joe Orton]
+
*) mod_proxy_ajp: Reduce memory usage in case of many keep-alive requests on
one connection. PR 52275. [Naohiro Ooiwa <naohiro ooiwa miraclelinux com>]
Modified: httpd/httpd/trunk/configure.in
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/configure.in?rev=1341905&r1=1341904&r2=1341905&view=diff
==============================================================================
--- httpd/httpd/trunk/configure.in (original)
+++ httpd/httpd/trunk/configure.in Wed May 23 15:42:33 2012
@@ -703,7 +703,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
AC_ARG_WITH(suexec-logfile,
APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
+ if test "x$withval" = "xyes"; then
+ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
+ fi
+])
+
+AC_ARG_WITH(suexec-syslog,
+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
+ if test $withval = "yes"; then
+ if test "x${with_suexec_logfile}" != "xno"; then
+ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
+ AC_MSG_ERROR([suexec does not support both logging to file and syslog])
+ fi
+ AC_CHECK_FUNCS([vsyslog], [], [
+ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
+ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
+ fi
+])
+
AC_ARG_WITH(suexec-safepath,
APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
Modified: httpd/httpd/trunk/support/suexec.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/suexec.c?rev=1341905&r1=1341904&r2=1341905&view=diff
==============================================================================
--- httpd/httpd/trunk/support/suexec.c (original)
+++ httpd/httpd/trunk/support/suexec.c Wed May 23 15:42:33 2012
@@ -58,6 +58,10 @@
#include <grp.h>
#endif
+#ifdef AP_LOG_SYSLOG
+#include <syslog.h>
+#endif
+
#if defined(PATH_MAX)
#define AP_MAXPATH PATH_MAX
#elif defined(MAXPATHLEN)
@@ -69,7 +73,12 @@
#define AP_ENVBUF 256
extern char **environ;
+
+#ifdef AP_LOG_SYSLOG
+static int log_open;
+#else
static FILE *log = NULL;
+#endif
static const char *const safe_env_lst[] =
{
@@ -137,7 +146,14 @@ static void err_output(int is_error, con
static void err_output(int is_error, const char *fmt, va_list ap)
{
-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+ if (!log_open) {
+ openlog("suexec", LOG_PID, LOG_DAEMON);
+ log_open = 1;
+ }
+
+ vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
+#elif defined(AP_LOG_EXEC)
time_t timevar;
struct tm *lt;
@@ -295,7 +311,9 @@ int main(int argc, char *argv[])
#ifdef AP_HTTPD_USER
fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
#endif
-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+ fprintf(stderr, " -D AP_LOG_SYSLOG\n");
+#elif defined(AP_LOG_EXEC)
fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
#endif
#ifdef AP_SAFE_PATH
@@ -591,6 +609,12 @@ int main(int argc, char *argv[])
#endif /* AP_SUEXEC_UMASK */
/* Be sure to close the log file so the CGI can't mess with it. */
+#ifdef AP_LOG_SYSLOG
+ if (log_open) {
+ closelog();
+ log_open = 0;
+ }
+#else
if (log != NULL) {
#if APR_HAVE_FCNTL_H
/*
@@ -612,6 +636,7 @@ int main(int argc, char *argv[])
log = NULL;
#endif
}
+#endif
/*
* Execute the command, replacing our image with its own.
Re: svn commit: r1341905 - in /httpd/httpd/trunk: CHANGES
configure.in support/suexec.c
Posted by Joe Orton <jo...@redhat.com>.
On Wed, May 30, 2012 at 07:50:44AM +0200, Kaspar Brand wrote:
> Wouldn't it be preferrable to use LOG_AUTH/LOG_AUTHPRIV instead?
> suexec's log messages are mostly about authorization, and sometimes
> include information which should probably be hidden from the eyes of
> unprivileged users.
Good point, yes - thanks! Done in r1344712.
Regards, Joe
Re: svn commit: r1341905 - in /httpd/httpd/trunk: CHANGES configure.in
support/suexec.c
Posted by Kaspar Brand <ht...@velox.ch>.
On 23.05.2012 17:42, jorton@apache.org wrote:
> Author: jorton
> Date: Wed May 23 15:42:33 2012
> New Revision: 1341905
>
> URL: http://svn.apache.org/viewvc?rev=1341905&view=rev
> Log:
> suexec: Add support for logging to syslog as an alternative to a
> logfile.
>
> * support/suexec.c (err_output) [AP_LOG_SYSLOG]: Log to syslog.
> (main): Close syslog fd if open, before execv. Add -V output
> for AP_LOG_SYSLOG.
[...]
> @@ -137,7 +146,14 @@ static void err_output(int is_error, con
>
> static void err_output(int is_error, const char *fmt, va_list ap)
> {
> -#ifdef AP_LOG_EXEC
> +#if defined(AP_LOG_SYSLOG)
> + if (!log_open) {
> + openlog("suexec", LOG_PID, LOG_DAEMON);
> + log_open = 1;
> + }
> +
> + vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
> +#elif defined(AP_LOG_EXEC)
> time_t timevar;
> struct tm *lt;
>
Wouldn't it be preferrable to use LOG_AUTH/LOG_AUTHPRIV instead?
suexec's log messages are mostly about authorization, and sometimes
include information which should probably be hidden from the eyes of
unprivileged users.
Kaspar
Re: svn commit: r1341905 - in /httpd/httpd/trunk: CHANGES
configure.in support/suexec.c
Posted by Joe Orton <jo...@redhat.com>.
On Fri, Jun 01, 2012 at 11:31:55AM +0200, Ruediger Pluem wrote:
> jorton@apache.org wrote:
> > --- httpd/httpd/trunk/configure.in (original)
> > +++ httpd/httpd/trunk/configure.in Wed May 23 15:42:33 2012
> > @@ -703,7 +703,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
> >
> > AC_ARG_WITH(suexec-logfile,
> > APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
> > - AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
> > + if test "x$withval" = "xyes"; then
>
> Shouldn't that be
>
> if test "x$withval" != "xno" -a "x$withval" != "x"; then
>
> otherwise AP_LOG_EXEC gets only defined if --with-suexec-logfile=yes and not if
> --with-suexec-logfile=/someplace/somefile
Good catch, yes, this was wrong. If --with-foo is given without an
argument, withval is set to "yes", so I've made it fail for that case.
http://svn.apache.org/viewvc?rev=1345147&view=rev
Regards, Joe
Re: svn commit: r1341905 - in /httpd/httpd/trunk: CHANGES configure.in
support/suexec.c
Posted by Ruediger Pluem <rp...@apache.org>.
jorton@apache.org wrote:
> Author: jorton
> Date: Wed May 23 15:42:33 2012
> New Revision: 1341905
>
> URL: http://svn.apache.org/viewvc?rev=1341905&view=rev
> Log:
> suexec: Add support for logging to syslog as an alternative to a
> logfile.
>
> * support/suexec.c (err_output) [AP_LOG_SYSLOG]: Log to syslog.
> (main): Close syslog fd if open, before execv. Add -V output
> for AP_LOG_SYSLOG.
>
> * configure.in: Add --with-suexec-syslog argument; allow
> --without-suexec-logfile to omit definition of AP_LOG_EXEC.
>
> Modified:
> httpd/httpd/trunk/CHANGES
> httpd/httpd/trunk/configure.in
> httpd/httpd/trunk/support/suexec.c
>
> Modified: httpd/httpd/trunk/configure.in
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/configure.in?rev=1341905&r1=1341904&r2=1341905&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/configure.in (original)
> +++ httpd/httpd/trunk/configure.in Wed May 23 15:42:33 2012
> @@ -703,7 +703,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
>
> AC_ARG_WITH(suexec-logfile,
> APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
> - AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
> + if test "x$withval" = "xyes"; then
Shouldn't that be
if test "x$withval" != "xno" -a "x$withval" != "x"; then
otherwise AP_LOG_EXEC gets only defined if --with-suexec-logfile=yes and not if
--with-suexec-logfile=/someplace/somefile
> + AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
> + fi
> +])
> +
> +AC_ARG_WITH(suexec-syslog,
> +APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
> + if test $withval = "yes"; then
> + if test "x${with_suexec_logfile}" != "xno"; then
> + AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
> + AC_MSG_ERROR([suexec does not support both logging to file and syslog])
> + fi
> + AC_CHECK_FUNCS([vsyslog], [], [
> + AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
> + AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
> + fi
> +])
> +
>
> AC_ARG_WITH(suexec-safepath,
> APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
>