Re: [APC-DEV] Spurious writes to /tmp

Hello Jay,

The /tmp/.apc.XXXXXX files are created because you're using file  
locking (the default):

apc_fcntl.c:
     40         char lock_path[] = "/tmp/.apc.XXXXXX";

If it's of use to you we could probably make this more path more  
configurable, but as a solution to get you up and running fixing /tmp  
permissions is one way.  You can also try out the IPC Semaphore,  
pthread, or spin locks out as well (pthread and spin locks being the  
fastest choices).

Sorry you had difficulties in getting to this list, the news server  
seems to be back up now: http://news.php.net/php.apc.dev.

-shire

On May 6, 2007, at 8:19 AM, Jay L. T. Cornwall wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello,
>
> I'm in the process of setting up a CentOS 5 installation, which ships
> with a tightened SELinux policy. APC is installed and working well,
> however I notice that on any access to a PHP script - or, confusingly,
> any CGI script also - these warnings are generated:
>
> avc: denied { read, write } for comm="test.sh" dev=dm-0 egid=48  
> euid=48
> exe="/bin/bash" exit=0 fsgid=48 fsuid=48 gid=48 items=0
> name=".apc.ZEAkwD"
>
> Elaborated by sealert:
>
> Source Context                user_u:system_r:httpd_sys_script_t
> Target Context                user_u:object_r:httpd_tmp_t
> Target Objects                /tmp/.apc.Yv21vf (deleted) [ file ]
>
> The "error" occurs because SELinux is configured to disallow CGI  
> scripts
> write access to /tmp, which is fine - I can fix that if it's desirable
> later. Two questions:
>
> 1) Why are these files created? My apc.ini specifies this:
>     apc.mmap_file_mask=/var/cache/apc/apc.XXXXXX
>
>    I assume mkstemp() is directing something towards /tmp but I'm not
>    sure why. If there's a need to generate temporary files then that's
>    fine, but it would be really nice to have an option to redirect  
> them
>    elsewhere. Giving CGI scripts access to /tmp makes a lot of generic
>    exploits that bit more likely to succeed.
>
> 2) Why is APC being invoked for CGI scripts that don't use PHP?
>
> Many thanks if you can shed some light on this. APC's a neat little  
> bit
> of software and if I can get this resolved, it'll play ball with  
> CentOS
> 5 (and by extension RHEL 5)!
>
> (Apologies if you receive this twice. Finding and getting onto this  
> list
> was really difficult - the mailing list archive site is down, the news
> server hasn't/isn't going to forward my post and someone's created  
> this
> highly hidden apc-dev list instead of the PECL one!)
>
> - --
> Jay L. T. Cornwall, http://www.esuna.co.uk/~jay/
> PhD Student
> Imperial College London
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFGPfH9oHnC75cy2zgRAlEMAJ9VcOe9nhfdjh8zBEHQFq5JA3iArgCdHwxE
> A3+1Ejg1hKMWPOujAxzhV2w=
> =A0kD
> -----END PGP SIGNATURE-----
>
> -- 
> APC Development Mailing List (http://pecl.php.net/APC)
> To unsubscribe, visit: http://www.php.net/unsub.php
>

- Shire
     [email protected]
     [email protected]