Author: jorton
Date: Mon Jun 1 13:02:06 2026
New Revision: 1934835
Log:
Merge r1617196, r1617201, r1618778, r1897269, r1927804 from trunk:
unixd_drop_privileges and ap_unixd_setup_child are almost the same,
so let's remove the redundant code.
geteuid is always successful,
so remove errno reference.
Follow up r1617201:
Return EPERM if the uid is not root on chroot-ing.
Pointed out by trawick on
<CAKUrXK6EGmG1ZD4+UFZ05yznTe6twOU3n57YeO-Ney-_VV_dCQ@mail.gmail.com>
mod_unixd: Make CoreDumpDirectory work for FreeBSD 11+. PR 65819.
FreeBSD 11+ coredumping requires tracing enabled via procctl(PROC_TRACE_CTL).
Submitted by: David CARLIER <devnexen gmail.com>
Reviewed by: ylavic (by inspection)
* modules/arch/unix/mod_unixd.ci (ap_unixd_setup_child):
Do not test euid=0 before going chroot
Nowaday chroot need CAP_SYS_CHROOT capability in its user namespace, and could
work without root.
Will allow to use chroot with lesser permission.
Submitted by: Bastien Roucariès <rouca debian.org>
PR: 69767
Submitted by: takashi, ylavic, jorton
Reviewed by: jorton, rpluem, covener
Github: closes #588
Added:
httpd/httpd/branches/2.4.x/changes-entries/CoreDumpDirectory-freebsd11.txt (contents, props changed)
httpd/httpd/branches/2.4.x/changes-entries/pr69767.txt (contents, props changed)
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/configure.in
httpd/httpd/branches/2.4.x/modules/arch/unix/mod_unixd.c
Added: httpd/httpd/branches/2.4.x/changes-entries/CoreDumpDirectory-freebsd11.txt
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ httpd/httpd/branches/2.4.x/changes-entries/CoreDumpDirectory-freebsd11.txt Mon Jun 1 13:02:06 2026 (r1934835)
@@ -0,0 +1,2 @@
+ *) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+.
+ PR 65819. [David CARLIER <devnexen gmail.com>]
Added: httpd/httpd/branches/2.4.x/changes-entries/pr69767.txt
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ httpd/httpd/branches/2.4.x/changes-entries/pr69767.txt Mon Jun 1 13:02:06 2026 (r1934835)
@@ -0,0 +1,3 @@
+ *) mod_unixd: Drop test that effective user ID is zero in
+ a chroot configuration. PR 69767.
+ [Bastien Roucaries <rouca debian.org>]
Modified: httpd/httpd/branches/2.4.x/configure.in
==============================================================================
--- httpd/httpd/branches/2.4.x/configure.in Mon Jun 1 12:55:40 2026 (r1934834)
+++ httpd/httpd/branches/2.4.x/configure.in Mon Jun 1 13:02:06 2026 (r1934835)
@@ -463,6 +463,7 @@ pwd.h \
grp.h \
strings.h \
sys/prctl.h \
+sys/procctl.h \
sys/processor.h \
sys/sem.h \
sys/sdt.h \
@@ -520,6 +521,7 @@ getgrnam \
initgroups \
bindprocessor \
prctl \
+procctl \
timegm \
getpgid \
fopen64 \
Modified: httpd/httpd/branches/2.4.x/modules/arch/unix/mod_unixd.c
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/arch/unix/mod_unixd.c Mon Jun 1 12:55:40 2026 (r1934834)
+++ httpd/httpd/branches/2.4.x/modules/arch/unix/mod_unixd.c Mon Jun 1 13:02:06 2026 (r1934835)
@@ -50,6 +50,9 @@
#ifdef HAVE_SYS_PRCTL_H
#include <sys/prctl.h>
#endif
+#ifdef HAVE_SYS_PROCCTL_H
+#include <sys/procctl.h>
+#endif
#ifndef DEFAULT_USER
#define DEFAULT_USER "#-1"
@@ -134,10 +137,14 @@ static int set_group_privs(void)
return 0;
}
-
static int
unixd_drop_privileges(apr_pool_t *pool, server_rec *s)
{
+ return ap_unixd_setup_child();
+}
+
+AP_DECLARE(int) ap_unixd_setup_child(void)
+{
int rv = set_group_privs();
if (rv) {
@@ -145,13 +152,6 @@ unixd_drop_privileges(apr_pool_t *pool,
}
if (NULL != ap_unixd_config.chroot_dir) {
- if (geteuid()) {
- rv = errno;
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02158)
- "Cannot chroot when not started as root");
- return rv;
- }
-
if (chdir(ap_unixd_config.chroot_dir) != 0) {
rv = errno;
ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02159)
@@ -198,6 +198,19 @@ unixd_drop_privileges(apr_pool_t *pool,
}
}
#endif
+#if defined(HAVE_PROCCTL) && defined(PROC_TRACE_CTL)
+ /* FreeBSD 11 and above */
+ if (ap_coredumpdir_configured) {
+ int enablecoredump = PROC_TRACE_CTL_ENABLE;
+ if (procctl(P_PID, 0, PROC_TRACE_CTL, &enablecoredump) != 0) {
+ rv = errno;
+ ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(10369)
+ "set dumpable failed - this child will not coredump"
+ " after software errors");
+ return rv;
+ }
+ }
+#endif
return OK;
}
@@ -326,58 +339,6 @@ unixd_pre_config(apr_pool_t *pconf, apr_
return OK;
}
-AP_DECLARE(int) ap_unixd_setup_child(void)
-{
- if (set_group_privs()) {
- return -1;
- }
-
- if (NULL != ap_unixd_config.chroot_dir) {
- if (geteuid()) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02164)
- "Cannot chroot when not started as root");
- return -1;
- }
- if (chdir(ap_unixd_config.chroot_dir) != 0) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02165)
- "Can't chdir to %s", ap_unixd_config.chroot_dir);
- return -1;
- }
- if (chroot(ap_unixd_config.chroot_dir) != 0) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02166)
- "Can't chroot to %s", ap_unixd_config.chroot_dir);
- return -1;
- }
- if (chdir("/") != 0) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02167)
- "Can't chdir to new root");
- return -1;
- }
- }
-
- /* Only try to switch if we're running as root */
- if (!geteuid() && (
-#ifdef _OSD_POSIX
- os_init_job_environment(NULL, ap_unixd_config.user_name, ap_exists_config_define("DEBUG")) != 0 ||
-#endif
- setuid(ap_unixd_config.user_id) == -1)) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02168)
- "setuid: unable to change to uid: %ld",
- (long) ap_unixd_config.user_id);
- return -1;
- }
-#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
- /* this applies to Linux 2.4+ */
- if (ap_coredumpdir_configured) {
- if (prctl(PR_SET_DUMPABLE, 1)) {
- ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL, APLOGNO(02169)
- "set dumpable failed - this child will not coredump"
- " after software errors");
- }
- }
-#endif
- return 0;
-}
static void unixd_dump_config(apr_pool_t *p, server_rec *s)
{
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.