Attachment #116599 for bug #158565

View | Details | Raw Unified | Return to bug 158565
Collapse All | Expand All

Lines 52-57 Link Here

(-)apache22/Makefile (-2 / +5 lines)
52	APACHEDIR= ${MASTERDIR}	52	APACHEDIR= ${MASTERDIR}
53	.endif	53	.endif
54		54
		55	WITH_MPM?= prefork # or worker, event, itk
		56
55	.if !defined(WITHOUT_APACHE_OPTIONS)	57	.if !defined(WITHOUT_APACHE_OPTIONS)
56	OPTIONS= \	58	OPTIONS= \
57	THREADS "Enable threads support in APR" Off \	59	THREADS "Enable threads support in APR" Off \
Lines 61-66 Link Here
61	IPV6 "Enable IPv6 support" On \	63	IPV6 "Enable IPv6 support" On \
62	BDB "Enable BerkeleyDB dbm" Off	64	BDB "Enable BerkeleyDB dbm" Off
63	.include "${APACHEDIR}/Makefile.options"	65	.include "${APACHEDIR}/Makefile.options"
		66	.if ${WITH_MPM:L} == "itk"
		67	OPTIONS+=ITK_LIMITS "mpm-itk rlimits based on login class" Off
		68	.endif
64	.endif	69	.endif
65		70
66	.if defined(WITH_SUEXEC_RSRCLIMIT)	71	.if defined(WITH_SUEXEC_RSRCLIMIT)
Lines 94-101 Link Here
94	MAKE_ENV+= EXPR_COMPAT=yes \	99	MAKE_ENV+= EXPR_COMPAT=yes \
95	INSTALL_MAN="${INSTALL_MAN}"	100	INSTALL_MAN="${INSTALL_MAN}"
96		101
97	WITH_MPM?= prefork # or worker, event, itk
98
99	WITH_HTTP_PORT?= 80	102	WITH_HTTP_PORT?= 80
100		103
101	.if defined(WITH_STATIC_SUPPORT)	104	.if defined(WITH_STATIC_SUPPORT)

Lines 65-70 Link Here

(-)apache22/Makefile.modules (+3 lines)
65	. elif ${WITH_MPM:L} == "itk"	65	. elif ${WITH_MPM:L} == "itk"
66	PLIST_SUB+= PREFORK="@comment " WORKER="@comment " EVENT="@comment "	66	PLIST_SUB+= PREFORK="@comment " WORKER="@comment " EVENT="@comment "
67	EXTRA_PATCHES+= ${PATCHDIR}/mpm-itk-${MPM_ITK_VERSION}	67	EXTRA_PATCHES+= ${PATCHDIR}/mpm-itk-${MPM_ITK_VERSION}
		68	. if defined (WITH_ITK_LIMITS)
		69	EXTRA_PATCHES+= ${PATCHDIR}/mpm-itk-limits
		70	. endif
68	. if defined (WITH_ITK_PERDIR_REGEX)	71	. if defined (WITH_ITK_PERDIR_REGEX)
69	EXTRA_PATCHES+= ${PATCHDIR}/mpm-itk-perdir-regex	72	EXTRA_PATCHES+= ${PATCHDIR}/mpm-itk-perdir-regex
70	. endif	73	. endif




--- server/mpm/experimental/itk/Makefile.in.orig	2011-07-01 10:33:45.000000000 +0000
+++ server/mpm/experimental/itk/Makefile.in	2011-07-01 10:33:57.000000000 +0000
@@ -1,5 +1,6 @@
 
 LTLIBRARY_NAME    = libitk.la
 LTLIBRARY_SOURCES = itk.c
+LTLIBRARY_LIBADD  = -lutil
 
 include $(top_srcdir)/build/ltlib.mk
--- server/mpm/experimental/itk/itk.c.orig	2011-07-01 10:04:40.000000000 +0000
+++ server/mpm/experimental/itk/itk.c	2011-07-01 10:17:19.000000000 +0000
@@ -41,6 +41,8 @@
 #if APR_HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
+#include <pwd.h>
+#include <login_cap.h>
 
 #define CORE_PRIVATE
 
@@ -1438,6 +1440,8 @@
     gid_t wanted_gid;
     const char *wanted_username;
     int err = 0;
+    struct passwd *pw;
+    login_cap_t *lc;
     
     itk_server_conf *sconf =
         (itk_server_conf *) ap_get_module_config(r->server->module_config, &mpm_itk_module);
@@ -1481,6 +1485,23 @@
         wanted_username = unixd_config.user_name;
     }
 
+    if ((pw = getpwuid(wanted_uid)) == NULL) {
+        _DBG("crit: invalid uid: (%ld)", wanted_uid, strerror(errno));
+        err = 1;
+    }
+
+    /*
+     * Apply user resource limits based on login class.
+     */
+    if ((lc = login_getclassbyname(pw->pw_class, pw)) == NULL) {
+        _DBG("failed to login_getclassbyname()", strerror(errno));
+        err = 1;
+    }
+    if ((setusercontext(lc, pw, wanted_uid, LOGIN_SETRESOURCES)) != 0) {
+        _DBG("failed to setusercontext()", strerror(errno));
+        err = 1;
+    }
+
     if (!err && wanted_uid != -1 && wanted_gid != -1 && (getuid() != wanted_uid || getgid() != wanted_gid)) {
         if (setgid(wanted_gid)) {
             _DBG("setgid(%d): %s", wanted_gid, strerror(errno));

Return to bug 158565

Line 0 Link Here

(-)apache22/files/mpm-itk-limits (+53 lines)
	1	--- server/mpm/experimental/itk/Makefile.in.orig 2011-07-01 10:33:45.000000000 +0000
	2	+++ server/mpm/experimental/itk/Makefile.in 2011-07-01 10:33:57.000000000 +0000
	3	@@ -1,5 +1,6 @@
	4
	5	LTLIBRARY_NAME = libitk.la
	6	LTLIBRARY_SOURCES = itk.c
	7	+LTLIBRARY_LIBADD = -lutil
	8
	9	include $(top_srcdir)/build/ltlib.mk
	10	--- server/mpm/experimental/itk/itk.c.orig 2011-07-01 10:04:40.000000000 +0000
	11	+++ server/mpm/experimental/itk/itk.c 2011-07-01 10:17:19.000000000 +0000
	12	@@ -41,6 +41,8 @@
	13	#if APR_HAVE_SYS_TYPES_H
	14	#include <sys/types.h>
	15	#endif
	16	+#include <pwd.h>
	17	+#include <login_cap.h>
	18
	19	#define CORE_PRIVATE
	20
	21	@@ -1438,6 +1440,8 @@
	22	gid_t wanted_gid;
	23	const char *wanted_username;
	24	int err = 0;
	25	+ struct passwd *pw;
	26	+ login_cap_t *lc;
	27
	28	itk_server_conf *sconf =
	29	(itk_server_conf *) ap_get_module_config(r->server->module_config, &mpm_itk_module);
	30	@@ -1481,6 +1485,23 @@
	31	wanted_username = unixd_config.user_name;
	32	}
	33
	34	+ if ((pw = getpwuid(wanted_uid)) == NULL) {
	35	+ _DBG("crit: invalid uid: (%ld)", wanted_uid, strerror(errno));
	36	+ err = 1;
	37	+ }
	38	+
	39	+ /*
	40	+ * Apply user resource limits based on login class.
	41	+ */
	42	+ if ((lc = login_getclassbyname(pw->pw_class, pw)) == NULL) {
	43	+ _DBG("failed to login_getclassbyname()", strerror(errno));
	44	+ err = 1;
	45	+ }
	46	+ if ((setusercontext(lc, pw, wanted_uid, LOGIN_SETRESOURCES)) != 0) {
	47	+ _DBG("failed to setusercontext()", strerror(errno));
	48	+ err = 1;
	49	+ }
	50	+
	51	if (!err && wanted_uid != -1 && wanted_gid != -1 && (getuid() != wanted_uid \|\| getgid() != wanted_gid)) {
	52	if (setgid(wanted_gid)) {
	53	_DBG("setgid(%d): %s", wanted_gid, strerror(errno));