Apache Module mod_privileges
<table class="module"><tr><th>
Description:</th><td>Suppor t for Solaris privileges and for running virtual hosts
under different user IDs.</td></tr>
<tr><th>
Status:</th><td>Experimental< /td></tr>
<tr><th>
Module Identifier:</th><t d>privileges_module</td></tr>
<tr><th>
Compatibility:</th><td>Av ailable in Apache 2.3 and up, on Solaris 10 and
OpenSolaris platforms</td></tr></table>
Summary
This module enables different Virtual Hosts to run with different
Unix™ <var>User</var> and <var>Group</var> IDs, and with different
Solari s Privileges. In particular, it offers a solution to the
problem of privilege separation between different Virtual Hosts, first
promised by the abandoned <code class="module">perchild</code> MPM.
It also offers other security enhancements.
Unlike <code class="module">perchild</code>, <code class="module">mod_privileges</code>
is not itself an MPM. It works within a processing model to
set privileges and User/Group per request in a running process.
It is therefore not compatible with a threaded MPM, and will refuse
to run under one.
<code class="module">mod_privileges</code> raises security issues similar to
those of suexec. But unlike suexec,
it applies not only to CGI programs but to the entire request processing
cycle, including in-process applications and subprocesses.
It is ideally suited to running PHP applications under mod_php,
which is also incompatible with threaded MPMs. It is also well-suited
to other in-process scripting applications such as mod_perl,
mod_python, and mod_ruby, and to
applications implemented in C as apache modules where privilege
separation is an issue.
<table class="directive">
<tr><th>
Description:</th><td>Det ermines whether the privileges required by dtrace are enabled.</td></tr>
<tr><th>
Syntax:</th><td><code>D TracePrivileges On|Off</code></td></tr>
<tr><th>
Default:</th><td><code> ;DTracePrivileges Off</code></td></tr>
<tr><th>
Context:</th><td>server config</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).</td></tr>
</table>
This server-wide directive determines whether Apache will run with
the privil eges required to run
dtrace.
Note that <var>DTracePrivileges On</var> will not in itself
activate DTrace, but <var>DTracePrivileges Off</var> will prevent
it working.
<table class="directive">
<tr><th>
Description:</th><td>Det ermines whether the virtualhost can run
subprocesses, and the privileges available to subprocesses.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostCGIMode On|Off|Secure</code></td></tr>
<tr><th>
Default:</th><td><code> ;VHostCGIMode On</code></td></tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).</td></tr>
</table>
Determines whether the virtual host is allowed to run fork and exec,
the privil eges required to run subprocesses. If this is set to
<var>Off</var> the virtualhost is denied the privileges and will not
be able to run traditional CGI programs or scripts under the traditional
<code class="module">mod_cgi</code>, nor similar external programs such as those
created by <code class="module">mod_ext_filter</code> or
<code class="directive">RewriteMap</code> <var>prog</var>.
Note that it does not prevent CGI programs running under alternative
process and security models such as mod_fcgid, which is a recommended solution in Solaris.
If set to <var>On</var> or <var>Secure</var>, the virtual host
is permitted to run external programs and scripts as above.
Setting <code class="directive">VHostCGIMode</code> <var>Secure</var> has
the effect of denying privileges to the subprocesses, as described
for <code class="directive">VHostSecure</code>.
<table class="directive">
<tr><th>
Description:</th><td>Ass ign arbitrary privileges to subprocesses created
by a virtual host.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr>
<tr><th>
Default:</th><td><code> ;None</code></td></tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM)
and when <code class="module">
mod_privileges</code> is compiled with the
<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr>
</table>
<code class="directive">VHostCGIPrivs</code> can be used to assign arbitrary privil eges to subprocesses created by a virtual host, as discussed
under <code class="directive">VHostCGIMode</code>. Each <var>privilege-name</var>
is the name of a Solaris privilege, such as <var>file_setid</var>
or <var>sys_nfs</var>.
A <var>privilege-name</var> may optionally be prefixed by
+ or -, which will respectively allow or deny a privilege.
If used with neither + nor -, all privileges otherwise assigned
to the virtualhost will be denied. You can use this to override
any of the default sets and construct your own privilege set.
Security
This directive can open huge security holes in apache subprocesses,
up to and including running them with root-level powers. Do not
use it unless you fully understand what you are doing!
<table class="directive">
<tr><th>
Description:</th><td>Set s the Group ID under which a virtual host runs.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostGroup <var>unix-groupid</var></code></td></tr>
<tr><th>
Default:</th><td><code> ;Inherits the group id specified in
<code class="directive">
Group</code></code></td&g t;</tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).</td></tr>
</table>
The <code class="directive">VHostGroup</code> directive sets the Unix group
under which the server will process requests to a virtualhost.
The group is set before the request is processed and reset afterwards
using Solari s Privileges. Since the setting applies to the
process, this is not compatible with threaded MPMs.
<var>Unix-group</var> is one of:
<dl>
<dt>A group name</dt>
<dd>Refers to the given group by name.</dd>
<dt><code>#</code> followed by a group number.</dt>
<dd>Refers to a group by its number.</dd>
</dl>
Security
This directive cannot be used to run apache as root!
Nevertheless, it opens potential security issues similar to
those discussed in the suexec
documentation.
See also
<table class="directive">
<tr><th>
Description:</th><td>Ass ign arbitrary privileges to a virtual host.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr>
<tr><th>
Default:</th><td><code> ;None</code></td></tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).
and when <code class="module">
mod_privileges</code> is compiled with the
<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr>
</table>
<code class="directive">VHostPrivs</code> can be used to assign arbitrary privil eges to a virtual host. Each <var>privilege-name</var>
is the name of a Solaris privilege, such as <var>file_setid</var>
or <var>sys_nfs</var>.
A <var>privilege-name</var> may optionally be prefixed by
+ or -, which will respectively allow or deny a privilege.
If used with neither + nor -, all privileges otherwise assigned
to the virtualhost will be denied. You can use this to override
any of the default sets and construct your own privilege set.
Security
This directive can open huge security holes in apache, up to
and including running requests with root-level powers. Do not
use it unless you fully understand what you are doing!
<table class="directive">
<tr><th>
Description:</th><td>Det ermines whether the server runs with enhanced security
for the virtualhost.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostSecure On|Off</code></td></tr>
<tr><th>
Default:</th><td><code> ;VHostSecure On</code></td></tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).</td></tr>
</table>
Determines whether the virtual host processes requests with
security enhanced by removal of Privil eges that are rarely needed in a webserver, but which are
available by default to a normal Unix user and may therefore
be required by modules and applications. It is recommended that
you retain the default (On) unless it prevents an application running.
Since the setting applies to the process, this is not
compatible with threaded MPMs.
Note
If <code class="directive">VHostSecure</code> prevents an application
running, this may be a warning sign that the application should be
reviewed for security.
<table class="directive">
<tr><th>
Description:</th><td>Set s the User ID under which a virtual host runs.</td></tr>
<tr><th>
Syntax:</th><td><code>V HostUser <var>unix-userid</var></code></td></tr>
<tr><th>
Default:</th><td><code> ;Inherits the userid specified in
<code class="directive">
User</code></code></td> </tr>
<tr><th>
Context:</th><td>virtual host</td></tr>
<tr><th>
Status:</th><td>Experimental& lt;/td></tr>
<tr><th>
Module:</th><td>mod_privilege s</td></tr>
<tr><th>
Compatibility:</th><td> ;Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<code class="module">
prefork</code> or custom MPM).</td></tr>
</table>
The <code class="directive">VHostUser</code> directive sets the Unix userid
under which the server will process requests to a virtualhost.
The userid is set before the request is processed and reset afterwards
using Solari s Privileges. Since the setting applies to the
process, this is not compatible with threaded MPMs.
<var>Unix-userid</var> is one of:
<dl>
<dt>A username</dt>
<dd>Refers to the given user by name.</dd>
<dt><code>#</code> followed by a user number.</dt>
<dd>Refers to a user by its number.</dd>
</dl>
Security
This directive cannot be used to run apache as root!
Nevertheless, it opens potential security issues similar to
those discussed in the suexec
documentation.
See also
