Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Apache: Dev

MPM-Module perchild

 

 

Apache dev RSS feed   Index | Next | Previous | View Threaded


christian4apache at lists

Nov 23, 2009, 1:40 AM

Post #1 of 7 (860 views)
Permalink
MPM-Module perchild

Hello,

We have an internal project where we need the MPM module perchild. The
Apache 2.0 documentation says that the development is not completed. I
talked to my boss and he says I could take maybe any necessary residual
activities, (depending on the size). Therefore, the following questions:

* What is currently state of this module?
* What would a collaboration?
* How is the planning of this module in Apache 2.2. The link of 'user'
(http://httpd.apache.org/docs/2.2/mod/mpm_common.html#user) and 'group'
(http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group) only brings
a 404 (http://httpd.apache.org/docs/2.2/mod/perchild.html).

Thank you for your info.
Christian


graham.dumpleton at gmail

Nov 23, 2009, 1:45 AM

Post #2 of 7 (816 views)
Permalink
Re: MPM-Module perchild [In reply to]

2009/11/23 <christian4apache [at] lists>:
> Hello,
>
> We have an internal project where we need the MPM module perchild. The
> Apache 2.0 documentation says that the development is not completed. I
> talked to my boss and he says I could take maybe any necessary residual
> activities, (depending on the size). Therefore, the following questions:
>
> * What is currently state of this module?
> * What would a collaboration?
> * How is the planning of this module in Apache 2.2. The link of 'user'
> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#user) and 'group'
> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group) only brings
> a 404 (http://httpd.apache.org/docs/2.2/mod/perchild.html).

First off I would be asking what specific code are you wanting to run
which requires this MPM. There are other means of achieving process
separation and dropping of privileges to different users than this
MPM. Whether other solutions are suitable really depends on what you
are wanting to do though.

So, explain what the actual requirement is rather than than your
suspected solution and may be can save you some time by suggesting
other ways you can achieve the same which doesn't require as much
work.

Graham

Graham


trawick at gmail

Nov 23, 2009, 4:09 AM

Post #3 of 7 (821 views)
Permalink
Re: MPM-Module perchild [In reply to]

On Mon, Nov 23, 2009 at 4:40 AM,
<christian4apache [at] lists> wrote:
> Hello,
>
> We have an internal project where we need the MPM module perchild. The
> Apache 2.0 documentation says that the development is not completed. I
> talked to my boss and he says I could take maybe any necessary residual
> activities, (depending on the size). Therefore, the following questions:
>
> * What is currently state of this module?
> * What would a collaboration?
> * How is the planning of this module in Apache 2.2. The link of 'user'
> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#user) and 'group'
> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group) only brings
> a 404 (http://httpd.apache.org/docs/2.2/mod/perchild.html).

perchild is no longer maintained here.

See

http://httpd.apache.org/docs/2.3/mod/mod_privileges.html (in future httpd 2.4)
http://mpm-itk.sesse.net/

(perhaps there are other projects out there which are still active?
Metux was active at some point.)


ed.herring at intel

Nov 23, 2009, 7:09 AM

Post #4 of 7 (807 views)
Permalink
RE: MPM-Module perchild [In reply to]

I would like to discuss a collaborative effort to get this module working.

-----Original Message-----
From: christian4apache [at] lists [mailto:christian4apache [at] lists]
Sent: Monday, November 23, 2009 3:40 AM
To: dev [at] httpd
Subject: MPM-Module perchild

Hello,

We have an internal project where we need the MPM module perchild. The
Apache 2.0 documentation says that the development is not completed. I
talked to my boss and he says I could take maybe any necessary residual
activities, (depending on the size). Therefore, the following questions:

* What is currently state of this module?
* What would a collaboration?
* How is the planning of this module in Apache 2.2. The link of 'user'
(http://httpd.apache.org/docs/2.2/mod/mpm_common.html#user) and 'group'
(http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group) only brings
a 404 (http://httpd.apache.org/docs/2.2/mod/perchild.html).

Thank you for your info.
Christian


graham.dumpleton at gmail

Nov 23, 2009, 1:51 PM

Post #5 of 7 (807 views)
Permalink
Re: MPM-Module perchild [In reply to]

2009/11/23 Jeff Trawick <trawick [at] gmail>:
> On Mon, Nov 23, 2009 at 4:40 AM,
> <christian4apache [at] lists> wrote:
>> Hello,
>>
>> We have an internal project where we need the MPM module perchild. The
>> Apache 2.0 documentation says that the development is not completed. I
>> talked to my boss and he says I could take maybe any necessary residual
>> activities, (depending on the size). Therefore, the following questions:
>>
>> * What is currently state of this module?
>> * What would a collaboration?
>> * How is the planning of this module in Apache 2.2. The link of 'user'
>> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#user) and 'group'
>> (http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group) only brings
>> a 404 (http://httpd.apache.org/docs/2.2/mod/perchild.html).
>
> perchild is no longer maintained here.
>
> See
>
> http://httpd.apache.org/docs/2.3/mod/mod_privileges.html (in future httpd 2.4)

FWIW, contrary to what is suggested by documentation for
mod_privileges, I would anticipate that modules which embed a Python
interpreter such as mod_python and mod_wsgi are not going to be
compatible with at least SECURE mode of mod_privileges. This is
because after a fork of a Python process special Python interpreter
core function has to be called to do some fixups. This is fine if fork
done from Python code as it will be done automatically, but not if
done from external C code in same process. Not sure how well things
will work if that fixup function isn't called.

So, in order for it to work, there would need to be optional hook
functions exposed by mod_privileges which would allow other modules to
run special actions after the fork. This though means that the
distinct modules would need to be customised to know about
mod_privileges.

BTW, what operating system feature does this use that means it is only
usable on Solaris?

Graham


nick at webthing

Nov 23, 2009, 2:16 PM

Post #6 of 7 (800 views)
Permalink
Re: MPM-Module perchild [In reply to]

Graham Dumpleton wrote:

>> http://httpd.apache.org/docs/2.3/mod/mod_privileges.html (in future httpd 2.4)
>
> FWIW, contrary to what is suggested by documentation for
> mod_privileges, I would anticipate that modules which embed a Python
> interpreter such as mod_python and mod_wsgi are not going to be
> compatible with at least SECURE mode of mod_privileges. This is
> because after a fork of a Python process special Python interpreter
> core function has to be called to do some fixups. This is fine if fork
> done from Python code as it will be done automatically, but not if
> done from external C code in same process. Not sure how well things
> will work if that fixup function isn't called.

That's entirely likely. Fast mode is straightforward, but secure
mode is only sparsely tested, and could easily fall down when presented
with complex problems as you suggest. In such a scenario we could
either fix it as you suggest (how does ITK deal with this?), or
bow out and recommend alternatives.

> BTW, what operating system feature does this use that means it is only
> usable on Solaris?

Is there another OS that supports solaris-style privileges?
One could envisage other modules to harness operating system
security - such as SElinux - but I don't think it would look
similar enough to abstract out a common API.

--
Nick Kew


christian4apache at lists

Nov 26, 2009, 6:08 PM

Post #7 of 7 (770 views)
Permalink
Re[2]: MPM-Module perchild [In reply to]

>> ... we need the MPM module perchild ...
> ... http://mpm-itk.sesse.net/ ...

The mpm-itk is what we search,

Thanks

Apache dev RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.