Re: cvs commit: apache-2.0/src/modules/mpm/winnt winnt.c

[Manoj Kasichainula <ma...@io.com>]

On Sat, May 27, 2000 at 02:18:28PM -0700, Greg Stein wrote:
> I think there should be. It isn't like MPMs need configuration merging.
> Seriously: what MPM is going to be hooking *ANY* of the request processing
> hooks? IMO, they shouldn't. Separating the types will clarify that.

I won't necessarily agree or disagree with you on this point; I'll
just propose a scenario, which is suexec.

suexec is a Unix only thing. It uses User and Group directives (soon
to be SuexecUser and SuexecGroup to lessen confusion). These need
merging. In addition, there will be data from request processing that
determines which user suexec decides on. One example is
<http://server/~user/blah.cgi>.

Now, how should this be done properly. The patch I sent out earlier
did this with a unix-only module called mod_suexec and a new
ap_create_privileged_process function that uses the suexec binary. The
hints from mod_userdir would be implemented using the notes table.

However, I've been pondering the possibility that the proper place for
this is unixd, and that means the MPM would be doing this. This is
process management after all. What do you think?

Re: MPM modules vs "normal" modules (was: cvs commit: ...)

[dean gaudet <dg...@arctic.org>]

On Sat, 24 Jun 2000, Greg Stein wrote:

> My impression was that MPMs handled accept processing. Other kinds of
> processing "should" go elsewhere.

of course since the MPM decides on the model of how processes and threads
are laid out, it affects "other processing" as well.  for example, it
totally affects what services APR offer.  of course most everyone
disagrees with me on that point, so whatever.

-dean

MPM modules vs "normal" modules (was: cvs commit: ...)

[Greg Stein <gs...@lyra.org>]

On Sun, Jun 18, 2000 at 08:13:56AM -0400, Manoj Kasichainula wrote:
> On Sat, May 27, 2000 at 02:18:28PM -0700, Greg Stein wrote:
> > I think there should be. It isn't like MPMs need configuration merging.
> > Seriously: what MPM is going to be hooking *ANY* of the request processing
> > hooks? IMO, they shouldn't. Separating the types will clarify that.
> 
> I won't necessarily agree or disagree with you on this point; I'll
> just propose a scenario, which is suexec.
> 
> suexec is a Unix only thing. It uses User and Group directives (soon
> to be SuexecUser and SuexecGroup to lessen confusion). These need
> merging. In addition, there will be data from request processing that
> determines which user suexec decides on. One example is
> <http://server/~user/blah.cgi>.
> 
> Now, how should this be done properly. The patch I sent out earlier
> did this with a unix-only module called mod_suexec and a new
> ap_create_privileged_process function that uses the suexec binary. The
> hints from mod_userdir would be implemented using the notes table.
> 
> However, I've been pondering the possibility that the proper place for
> this is unixd, and that means the MPM would be doing this. This is
> process management after all. What do you think?


My impression was that MPMs handled accept processing. Other kinds of
processing "should" go elsewhere.

Cheers,
-g

-- 
Greg Stein, http://www.lyra.org/

RE: cvs commit: apache-2.0/src/modules/mpm/winnt winnt.c

["William A. Rowe, Jr." <wr...@lnd.com>]

> From: Manoj Kasichainula [mailto:manoj@io.com]
> Sent: Sunday, June 18, 2000 7:14 AM
> 
> However, I've been pondering the possibility that the proper place for
> this is unixd, and that means the MPM would be doing this. This is
> process management after all. What do you think?

I think you are dead on.  My next pet project, for the month of July,
is to implement suexec/winnt (winnt, no, not win9x, not now, not ever,
it simply is -not- robust, or secure, or appropriate.  If they want
system level security, they run Apache on an OS with system level
security.)  

Of course suExecUser and suExecGroup and such may not transfer quite
'naturally' to NT, but alot of concept level stuff should be common,
and in fact there may be quite alot of code that can be shared.

I was almost thinking about another OS-specific module, before we
begin corrupting the mpm, of creating a platform model security 
module (psm, or smm) to implement the security details.  The neat
part is that there is only one, even if you are using pthreads or
prefork, and we don't need to overlap entirely.

Before someone goes ranting that 'this belongs in apr'... many concepts
will be similar, but most details will be divergent, right down to the
permissions (what does 644 mean to win32?  or worse, 711?)  The .conf
params will even change, although as little as they must, to support
the engine.

Thoughts?

Bill

RE: cvs commit: apache-2.0/src/modules/mpm/winnt winnt.c

["William A. Rowe, Jr." <wr...@lnd.com>]

> From: Daniel S. Reichenbach [mailto:dsr@opensa.org]
> Sent: Sunday, June 18, 2000 3:05 PM
> 
> > suexec is a Unix only thing. It uses User and Group directives (soon
> > to be SuexecUser and SuexecGroup to lessen confusion). These need
> > merging. In addition, there will be data from request processing
>
> Just a question for those Win32 guys: M$ has integrated some similar
> thing to suexec into Win2k, which allows to run programs etc. under
> a different userid. If this function is accessible for programs,
> things would even get uglier. I didn`t find something about it in the
> Platform SDK yet, just stumbled accross it while testing Win2k.

I think alot of Winnt folk are looking down this direction.  Frankly, 
I don't trust using the M$ binaries beyond the Win32 API in Apache... 
I agree with the general Apache community that security that can be 
audited by everyone is healthy.  That executable is best made taboo.

But I'm looking a little deeper, allowing the server to call the
ImpersonateUser functions to layer on security within specific CGI
or web folders.  There are huge ramifacations, I am aware.  The rules
will be -extremely- tight to pull it off.  But I believe it can be
safely done.

To cover the concerns, I believe the natural unix behavior (without
enabling suexec) could be a crossplatform-no impersonation base model.
The unix suexec or suexec/Win32 would each be their own beasts, with
the additional code to handle this security.  Unix probably wouldn't
change much, but several different unix thread/process mpm's could
probably share the same suexec module.  Win32's would look entirely
different, of course, but retain as much in common with the rules,
behaviors and config directives of suexec.

RE: cvs commit: apache-2.0/src/modules/mpm/winnt winnt.c

["Daniel S. Reichenbach" <ds...@opensa.org>]

> suexec is a Unix only thing. It uses User and Group directives (soon
> to be SuexecUser and SuexecGroup to lessen confusion). These need
> merging. In addition, there will be data from request processing
Just a question for those Win32 guys: M$ has integrated some similar
thing to suexec into Win2k, which allows to run programs etc. under
a different userid. If this function is accessible for programs,
things would even get uglier. I didn`t find something about it in the
Platform SDK yet, just stumbled accross it while testing Win2k.

/me
--
Open Server Architecture project                http://www.opensa.org/
Daniel S. Reichenbach                                   dsr@opensa.org