Instead of using mod_userdir and mod_suexec specific hacks, we now run the hook
on the httpd side of the handler.
If this is NULL, we pass on a magic empty_ugid constant, otherwise pass on the
real ugid.
On the cgid side of the equation, we add our own hook, with REALLY_FIRST, and
then order the hooks. This ensures that cgid's doer runs before any other
registered get_suexec_identity doers.
We use cgid's request config to store the ugid. If ugid == empty_ugid, we DON'T
call ap_os_create_privileged_process, because our doer would return the magic
empty_ugid constant. Having the doer return NULL is no good, because then
userdir and mod_suexec's doers would be called. Instead, we call plain old
apr_proc_create().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264759 13f79535-47bb-0310-9956-ffa450edef68
invoked cgi application, to conform to the behavior of mod_cgi.
PR: 34542
Reviewed by: Andre, OtherBill
Submitted by: Pradeep Kumar S <pradeep.smani gmail.com>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264623 13f79535-47bb-0310-9956-ffa450edef68
running instances of httpd will not clobber each others script sockets.
Because a different socket will be created for each instance, this change also
unlinks the script-socket on exit, to prevent pollution.
unlink() happens from within the parent process, since the change in userid's
means the cgid process likely won't have the correct permissions.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@240044 13f79535-47bb-0310-9956-ffa450edef68
Don't place script socket inside default server root instead of
actual server root.
The sock name was being stored in the server config, though it
was not specific to a server.
ap_server_root_relative() was being used prior to config processing,
so it was always picking up the default server root.
PR: 27886
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103184 13f79535-47bb-0310-9956-ffa450edef68
AIX.
On AIX, for processes like mod_cgid's script children where
SIGCHLD is ignored, kill(pid,0) returns success for up to
one second after the script child exits, based on when a
daemon runs to clean up unnecessary process table entries.
getpgid() can report the proper info (-1/ESRCH) immediately.
One user had a page with a lot of embedded images created by
CGIs, and the browser fetched them on a keepalive connection,
and the cumulative delays were very noticeable by the clients.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101716 13f79535-47bb-0310-9956-ffa450edef68
SECURITY [CAN-2003-0789]: mod_cgid: Resolve some mishandling of
the AF_UNIX socket used to communicate with the cgid daemon and
the CGI script.
Submitted by: Jeff Trawick
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101570 13f79535-47bb-0310-9956-ffa450edef68
result in the wrong script being cleaned up at the end of a
request.
Unique storage was not used for the key, as the code assumed
incorrectly that apr_hash_set() made a copy of the key. Thus,
when the script pid was looked up at the end of the request,
some other script's pid could be found.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101374 13f79535-47bb-0310-9956-ffa450edef68
because of the changes to the argument lists of apr_mmap_dup and apr_socket_create,
2.1-dev won't build with apr and apr-util's 0.9 branch anymore
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101154 13f79535-47bb-0310-9956-ffa450edef68
various operational problems in a threaded MPM, since on the
second attempt to close the socket, the same descriptor was
often already in use by another thread for another purpose.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100320 13f79535-47bb-0310-9956-ffa450edef68
has no 'real' request_rec, so we can't use ap_log_rerror() anywhere
within the cgid_server() code.
Also, one of the two log messages was echoed to the child, no point
when the actual request logic should take care of that notification.
Submitted by: Jeff Trawick
Reviewed by: Bill Rowe
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99132 13f79535-47bb-0310-9956-ffa450edef68
be started on Unix because of such problems as bad permissions,
bad shebang line, etc.
Some minor points:
If mod_ext_filter debug is enabled, we go ahead and burn cycles
in the parent to try to discover when we won't be able to exec
the script.
The mod_cgid handler wasn't communicating the right log level to the
daemon; that was required to get the child errfn to spit out the
right message, and it may fix an existing problem.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98630 13f79535-47bb-0310-9956-ffa450edef68
Communication between handler and daemon used newlines to delimit
environment variables, which threw everything off when an environment
variable contained a newline.
Communication between handler and daemon was extensively reworked.
Environment variables were handled as in the patch submitted by
Piotr Czejkowski.
PR: 14550
Submitted by: Piotr Czejkowski <apache@czarny.eu.org>, Jeff Trawick
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97530 13f79535-47bb-0310-9956-ffa450edef68
find the script pid in the hash and returns zero... if we send
sigterm to pid zero, we knock out ourself
change the cleanup to return any error from cleanup_nonchild_process()
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97493 13f79535-47bb-0310-9956-ffa450edef68
drops.
This is done by mod_cgid daemon remembering the pid, which is queried
by the handler at the end of the request. The handler then
knocks out the CGI script (if it is indeed still running).
It would be slightly easier for the daemon to do this, but naughty
scripts which are hard to kill would hold up all new CGI requests
if the daemon stopped its normal processing to kill a script.
PR: 8388
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97489 13f79535-47bb-0310-9956-ffa450edef68
