Re: Rather complex question about chroot and suexec

Ben Chabot wrote:
> Well, I have mod_fascgi using an suexec wrapper and chroot'ing setting 
> UID.  They are both working, but when I run scripts with FastCgiWrapper 
> set to suexec, I get "No input file specified".. when I strace the 
> running php-fcgi process, I see it's still looking for the full path, 
> even though the environment variable is rewritten in my suexec wrapper...
>
> So... can anyone PLEASE shed some light on what you have to do to 
> chroot() dynamic processes... I'm so close, but missing somewhere in the 
> code where I need to set the correct paths to everything works right.  
> I'm certain one of the developers could at least give me an idea of the 
> flow of a request through apache, the module, the process manager, the 
> wrapper and the php binary.  So perhaps I could figure out what I need 
> to fix to get this to work right.
>
> Thank you very much,
> Ben
>
>
>   
I'm struggling with Ben to get PHP running with apache on different
UID/GID and inside chroot.
Right now i have configuration where every vhost has its own root folder
(with /etc, /bin, /usr ...).
Every vhost has it's own php4 binary inside it's root folder.

Eg. www.example.com.
RootFolder: /home/vhosts/example.com/
DocumentRoot: /home/vhosts/example.com/www
PHP Binary: /home/vhosts/example.com/usr/bin/php4-cgi

I use home made wrapper based on suexec and sbox, that starts php
process with apropriate UID/GID and does chroot to vhosts root folder.
I can confirm, that FastCGI configuration is correct, i get my php
process running persistent in ps listing.

Now the problem is that when browsing for www.example.com/test.php,
apache translates this request to /home/vhosts/example.com/www/test.php
and passes it to mod_fastcgi. As you can imagine result of this is "No
input files" message, because running PHP process should get this
request like /www/test.php (without part outside its root folder).

I've managed to solve this by tweaking mod_rewrite to handle this
translation, but i don't like this method.

If someone could post what is the exact request flow between apache,
mod_fastcgi, fcgi-pm and running php process, that would really help me.
If i could find place inside mod_fastcgi between read request from
apache and write to listening php process, i could strip this path to
correct value.

Another issue: if i want to have php process inside chroot, i have to
get unix communication socket open before the process get's chrooted.
How will this work with high load (fcgi-pm spawns additional processes
to handle requests) ? Do fcgi-pm use wrapper to run new processes ? What
about communication socket, do all processes use the same socket, or
does everyone has its own ?

I really hope someone could share some knowledge.
Best regards
Maciej





___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/