Mpm-itk and FastCGI

Hi,

For those of you who don't know: mpm-itk is an MPM for Apache2, based on 
the prefork-MPM, that allows you to run different virtual hosts as 
different users. See http://home.samfundet.no/~sesse/mpm-itk/.

This works quite nice, but it doesn't cooperate with FastCGI, when used 
with dynamic servers. With mpm-itk, the apache 'workers' run as 
different users, while the fcgi process manager runs as nobody, 
www-data, or whatever user you have configured Apache to use with the 
'User' directive.

The process manager creates Unix sockets in $FastCgiIpcDir/dynamic. The 
directory itself has mode 700 and the sockets have mode 600. With 
mpm-itk in action, this means the webserver cannot access these sockets.

I have attached a patch against mod_fastcgi 2.4.2,that makes the process 
manager chmod the sockets to 666 instead of 600. If one manually chmods 
the socket directory to 755, this will enable Apache + mpm-itk to access 
the sockets and use dynamic FastCGI applications like ever before.

I realize that there may be security implications, but with the default 
mode 700 of the socket directory, it's hardly any less secure.

Best regards,

Martijn Grendelman

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/

--- libapache-mod-fastcgi-2.4.2-prebuild/fcgi_pm.c	2003-10-30 02:08:34.000000000 +0100
+++ libapache-mod-fastcgi-2.4.2/fcgi_pm.c	2006-12-12 20:19:29.000000000 +0100
@@ -242,7 +242,8 @@
 #ifndef WIN32
     /* Twiddle Unix socket permissions */
     else if (fs->socket_addr->sa_family == AF_UNIX
-        && chmod(((struct sockaddr_un *)fs->socket_addr)->sun_path, S_IRUSR | S_IWUSR))
+        && chmod(((struct sockaddr_un *)fs->socket_addr)->sun_path, 
+		S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH ))
     {
         ap_log_error(FCGI_LOG_CRIT, fcgi_apache_main_server,
             "FastCGI: can't create %sserver \"%s\": chmod() of socket failed",