manual/mod/mod_privileges.xml

<?xml version="1.0"?>
<!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
<?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
<!-- $LastChangedRevision$ -->

<!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-->

<modulesynopsis metafile="mod_privileges.xml.meta">

<name>mod_privileges</name>
<description>Support for Solaris privileges and for running virtual hosts
under different user IDs.</description>
<status>Experimental</status>
<identifier>privileges_module</identifier>
<compatibility>Available in Apache 2.3 and up, on Solaris 10 and
OpenSolaris platforms</compatibility>

<summary>
<p>This module enables different Virtual Hosts to run with different
Unix&trade; <var>User</var> and <var>Group</var> IDs, and with different
<a href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
>Solaris Privileges</a>.  In particular, it offers a solution to the
problem of privilege separation between different Virtual Hosts, first
promised by the abandoned perchild MPM.  It also offers other security
enhancements.</p>

<p>Unlike perchild, <module>mod_privileges</module>
is not itself an MPM.  It works <em>within</em> a processing model to
set privileges and User/Group <em>per request</em> in a running process.
It is therefore not compatible with a threaded MPM, and will refuse
to run under one.</p>

<p><module>mod_privileges</module> raises security issues similar to
those of <a href="../suexec.html">suexec</a>.  But unlike suexec,
it applies not only to CGI programs but to the entire request processing
cycle, including in-process applications and subprocesses.
It is ideally suited to running PHP applications under <strong>mod_php</strong>,
which is also incompatible with threaded MPMs.  It is also well-suited
to other in-process scripting applications such as <strong>mod_perl</strong>,
<strong>mod_python</strong>, and <strong>mod_ruby</strong>, and to
applications implemented in C as apache modules where privilege
separation is an issue.</p>

</summary>

<section id="security"><title>Security Considerations</title>

<p><module>mod_privileges</module> introduces new security concerns
in situations where <strong>untrusted code</strong> may be run
<strong>within the webserver process</strong>.  This applies to
untrusted modules, and scripts running under modules such as
mod_php or mod_perl.  Scripts running externally (e.g. as CGI
or in an appserver behind mod_proxy or mod_jk) are NOT affected.</p>

<p>The basic security concerns with mod_privileges are:</p>
<ul><li>Running as a system user introduces the same security issues
    as mod_suexec, and near-equivalents such as cgiwrap and suphp.</li>
<li>A privileges-aware malicious user extension (module or script)
    could escalate its privileges to anything available to the
    httpd process in any virtual host.  This introduces new risks
    if (and only if) mod_privileges is compiled with the
    <var>BIG_SECURITY_HOLE</var> option.</li>
<li>A privileges-aware malicious user extension (module or script)
    could escalate privileges to set its user ID to another system
    user (and/or group).</li>
</ul>

<p>The <directive>PrivilegesMode</directive> directive allows you to
select either <var>FAST</var> or <var>SECURE</var> mode.  You can
mix modes, using <var>FAST</var> mode for trusted users and
fully-audited code paths, while imposing SECURE mode where an
untrusted user has scope to introduce code.</p>
<p>Before describing the modes, we should also introduce the target
use cases: Benign vs Hostile.  In a benign situation, you want to
separate users for their convenience, and protect them and the server
against the risks posed by honest mistakes, but you trust your users
are not deliberately subverting system security.  In a hostile
situation - e.g. commercial hosting - you may have users deliberately
attacking the system or each other.</p>
<dl>
<dt>FAST mode</dt>
<dd>In <var>FAST</var> mode, requests are run in-process with the
selected uid/gid and privileges, so the overhead is negligible.
This is suitable for benign situations, but is not secure against an
attacker escalating privileges with an in-process module or script.</dd>
<dt>SECURE mode</dt>
<dd>A request in <var>SECURE</var> mode forks a subprocess, which
then drops privileges.  This is a very similar case to running CGI
with suexec, but for the entire request cycle, and with the benefit
of fine-grained control of privileges.</dd>
</dl>
<p>You can select different <directive>PrivilegesMode</directive>s for
each virtual host, and even in a directory context within a virtual
host.  <var>FAST</var> mode is appropriate where the user(s) are
trusted and/or have no privilege to load in-process code.
<var>SECURE</var> mode is appropriate to cases where untrusted code
might be run in-process.  However, even in <var>SECURE</var> mode,
there is no protection against a malicious user who is able to
introduce privileges-aware code running <em>before the start of the
request-processing cycle.</em></p>

</section>
<directivesynopsis>
<name>PrivilegesMode</name>
<description>Trade off processing speed and efficiency vs security against
malicious privileges-aware code.</description>
<syntax>PrivilegesMode FAST|SECURE|SELECTIVE</syntax>
<contextlist>
	<context>server config</context>
	<context>virtual host</context>
	<context>directory</context>
</contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
<usage><p>This directive trades off performance vs security against
malicious, privileges-aware code.  In <var>SECURE</var> mode, each request
runs in a secure subprocess, incurring a substantial performance penalty.
In <var>FAST</var> mode, the server is not protected against escalation
of privileges as discussed above.</p>
<p>This directive differs slightly between a <code>&lt;Directory&gt;</code>
	context (including equivalents such as Location/Files/If) and a
	top-level or <code>&lt;VirtualHost&gt;</code>.</p>
<p>At top-level, it sets a default that will be inherited by virtualhosts.
	In a virtual host, FAST or SECURE mode acts on the entire
	HTTP request, and any settings in a <code>&lt;Directory&gt;</code>
	context will be <strong>ignored</strong>.  A third pseudo-mode
	SELECTIVE defers the choice of FAST vs SECURE to directives in a
	<code>&lt;Directory&gt;</code> context.</p>
<p>In a <code>&lt;Directory&gt;</code> context, it is applicable only
	where SELECTIVE mode was set for the VirtualHost.  Only
	FAST or SECURE can be set in this context (SELECTIVE would be
meaningless).</p>
<note type="warning"><title>Warning</title>
	Where SELECTIVE mode is selected for a virtual host, the activation
	of privileges must be deferred until <em>after</em> the mapping
	phase of request processing has determined what
	<code>&lt;Directory&gt;</code> context applies to the request.
	This might give an attacker opportunities to introduce
	code through a <directive module="mod_rewrite">RewriteMap</directive>
	running at top-level or <code>&lt;VirtualHost&gt;</code> context
	<em>before</em> privileges have been dropped and userid/gid set.
</note>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>VHostUser</name>
<description>Sets the User ID under which a virtual host runs.</description>
<syntax>VHostUser <var>unix-userid</var></syntax>
<default>Inherits the userid specified in
<directive module="mod_unixd">User</directive></default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>

<usage>
    <p>The <directive>VHostUser</directive> directive sets the Unix userid
    under which the server will process requests to a virtualhost.
    The userid is set before the request is processed and reset afterwards
    using <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >Solaris Privileges</a>.  Since the setting applies to the
    <em>process</em>, this is not compatible with threaded MPMs.</p>
    <p><var>Unix-userid</var> is one of:</p>
    <dl>
      <dt>A username</dt>
      <dd>Refers to the given user by name.</dd>

      <dt><code>#</code> followed by a user number.</dt>
      <dd>Refers to a user by its number.</dd>
    </dl>

    <note type="warning"><title>Security</title>
    <p>This directive cannot be used to run apache as root!
    Nevertheless, it opens potential security issues similar to
    those discussed in the <a href="../suexec.html">suexec</a>
    documentation.</p></note>
</usage>
<seealso><directive module="mod_unixd">User</directive></seealso>
<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
</directivesynopsis>

<directivesynopsis>
<name>VHostGroup</name>
<description>Sets the Group ID under which a virtual host runs.</description>
<syntax>VHostGroup <var>unix-groupid</var></syntax>
<default>Inherits the group id specified in
<directive module="mod_unixd">Group</directive></default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>

<usage>
    <p>The <directive>VHostGroup</directive> directive sets the Unix group
    under which the server will process requests to a virtualhost.
    The group is set before the request is processed and reset afterwards
    using <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >Solaris Privileges</a>.  Since the setting applies to the
    <em>process</em>, this is not compatible with threaded MPMs.</p>
    <p><var>Unix-group</var> is one of:</p>
    <dl>
      <dt>A group name</dt>
      <dd>Refers to the given group by name.</dd>

      <dt><code>#</code> followed by a group number.</dt>
      <dd>Refers to a group by its number.</dd>
    </dl>

    <note type="warning"><title>Security</title>
    <p>This directive cannot be used to run apache as root!
    Nevertheless, it opens potential security issues similar to
    those discussed in the <a href="../suexec.html">suexec</a>
    documentation.</p></note>
</usage>
<seealso><directive module="mod_unixd">Group</directive></seealso>
<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
</directivesynopsis>

<directivesynopsis>
<name>VHostSecure</name>
<description>Determines whether the server runs with enhanced security
for the virtualhost.</description>
<syntax>VHostSecure On|Off</syntax>
<default>VHostSecure On</default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>

<usage>
    <p>Determines whether the virtual host processes requests with
    security enhanced by removal of <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >Privileges</a> that are rarely needed in a webserver, but which are
    available by default to a normal Unix user and may therefore
    be required by modules and applications.  It is recommended that
    you retain the default (On) unless it prevents an application running.
    Since the setting applies to the <em>process</em>, this is not
    compatible with threaded MPMs.</p>
    <note><title>Note</title>
    <p>If <directive>VHostSecure</directive> prevents an application
    running, this may be a warning sign that the application should be
    reviewed for security.</p></note>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>VHostCGIMode</name>
<description>Determines whether the virtualhost can run
subprocesses, and the privileges available to subprocesses.</description>
<syntax>VHostCGIMode On|Off|Secure</syntax>
<default>VHostCGIMode On</default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>

<usage>
    <p>Determines whether the virtual host is allowed to run fork and exec,
    the <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >privileges</a> required to run subprocesses.  If this is set to
    <var>Off</var> the virtualhost is denied the privileges and will not
    be able to run traditional CGI programs or scripts under the traditional
    <module>mod_cgi</module>, nor similar external programs such as those
    created by <module>mod_ext_filter</module> or
    <directive module="mod_rewrite">RewriteMap</directive> <var>prog</var>.
    Note that it does not prevent CGI programs running under alternative
    process and security models such as <a href="http://fastcgi.coremail.cn"
    >mod_fcgid</a>, which is a recommended solution in Solaris.</p>
    <p>If set to <var>On</var> or <var>Secure</var>, the virtual host
    is permitted to run external programs and scripts as above.
    Setting <directive>VHostCGIMode</directive> <var>Secure</var> has
    the effect of denying privileges to the subprocesses, as described
    for <directive>VHostSecure</directive>.</p>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>DTracePrivileges</name>
<description>Determines whether the privileges required by dtrace are enabled.</description>
<syntax>DTracePrivileges On|Off</syntax>
<default>DTracePrivileges Off</default>
<contextlist><context>server config</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>

<usage>
    <p>This server-wide directive determines whether Apache will run with
    the <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >privileges</a> required to run
    <a href="http://www.sun.com/bigadmin/content/dtrace/">dtrace</a>.
    Note that <var>DTracePrivileges On</var> will not in itself
    activate DTrace, but <var>DTracePrivileges Off</var> will prevent
    it working.</p>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>VHostPrivs</name>
<description>Assign arbitrary privileges to a virtual host.</description>
<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
<default>None</default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM)
and when <module>mod_privileges</module> is compiled with the
<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>

<usage>
    <p><directive>VHostPrivs</directive> can be used to assign arbitrary <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >privileges</a> to a virtual host.  Each <var>privilege-name</var>
    is the name of a Solaris privilege, such as <var>file_setid</var>
    or <var>sys_nfs</var>.</p>

    <p>A <var>privilege-name</var> may optionally be prefixed by
    + or -, which will respectively allow or deny a privilege.
    If used with neither + nor -, all privileges otherwise assigned
    to the virtualhost will be denied.  You can use this to override
    any of the default sets and construct your own privilege set.</p>

    <note type="warning"><title>Security</title>
    <p>This directive can open huge security holes in apache, up to
    and including running requests with root-level powers.  Do not
    use it unless you fully understand what you are doing!</p></note>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>VHostCGIPrivs</name>
<description>Assign arbitrary privileges to subprocesses created
by a virtual host.</description>
<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
<default>None</default>
<contextlist><context>virtual host</context></contextlist>
<compatibility>Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (<module>prefork</module> or custom MPM)
and when <module>mod_privileges</module> is compiled with the
<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>

<usage>
    <p><directive>VHostCGIPrivs</directive> can be used to assign arbitrary <a
    href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
    >privileges</a> to subprocesses created by a virtual host, as discussed
    under <directive>VHostCGIMode</directive>.  Each <var>privilege-name</var>
    is the name of a Solaris privilege, such as <var>file_setid</var>
    or <var>sys_nfs</var>.</p>

    <p>A <var>privilege-name</var> may optionally be prefixed by
    + or -, which will respectively allow or deny a privilege.
    If used with neither + nor -, all privileges otherwise assigned
    to the virtualhost will be denied.  You can use this to override
    any of the default sets and construct your own privilege set.</p>

    <note type="warning"><title>Security</title>
    <p>This directive can open huge security holes in apache subprocesses,
    up to and including running them with root-level powers.  Do not
    use it unless you fully understand what you are doing!</p></note>
</usage>
</directivesynopsis>


</modulesynopsis>
1	niq	713961	<?xml version="1.0"?>
2			<!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
3			<?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
4	rpluem	718015	<!-- $LastChangedRevision$ -->
5	niq	713961
6			<!--
7			Licensed to the Apache Software Foundation (ASF) under one or more
8			contributor license agreements. See the NOTICE file distributed with
9			this work for additional information regarding copyright ownership.
10			The ASF licenses this file to You under the Apache License, Version 2.0
11			(the "License"); you may not use this file except in compliance with
12			the License. You may obtain a copy of the License at
13
14			http://www.apache.org/licenses/LICENSE-2.0
15
16			Unless required by applicable law or agreed to in writing, software
17			distributed under the License is distributed on an "AS IS" BASIS,
18			WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19			See the License for the specific language governing permissions and
20			limitations under the License.
21			-->
22
23			<modulesynopsis metafile="mod_privileges.xml.meta">
24
25			<name>mod_privileges</name>
26			<description>Support for Solaris privileges and for running virtual hosts
27			under different user IDs.</description>
28			<status>Experimental</status>
29			<identifier>privileges_module</identifier>
30			<compatibility>Available in Apache 2.3 and up, on Solaris 10 and
31			OpenSolaris platforms</compatibility>
32
33			<summary>
34			<p>This module enables different Virtual Hosts to run with different
35			Unix™ <var>User</var> and <var>Group</var> IDs, and with different
36			<a href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
37			>Solaris Privileges</a>. In particular, it offers a solution to the
38			problem of privilege separation between different Virtual Hosts, first
39	trawick	758613	promised by the abandoned perchild MPM. It also offers other security
40			enhancements.</p>
41	niq	713961
42	trawick	758613	<p>Unlike perchild, <module>mod_privileges</module>
43	niq	713961	is not itself an MPM. It works <em>within</em> a processing model to
44			set privileges and User/Group <em>per request</em> in a running process.
45			It is therefore not compatible with a threaded MPM, and will refuse
46			to run under one.</p>
47
48			<p><module>mod_privileges</module> raises security issues similar to
49			those of <a href="../suexec.html">suexec</a>. But unlike suexec,
50			it applies not only to CGI programs but to the entire request processing
51			cycle, including in-process applications and subprocesses.
52			It is ideally suited to running PHP applications under <strong>mod_php</strong>,
53			which is also incompatible with threaded MPMs. It is also well-suited
54			to other in-process scripting applications such as <strong>mod_perl</strong>,
55			<strong>mod_python</strong>, and <strong>mod_ruby</strong>, and to
56			applications implemented in C as apache modules where privilege
57			separation is an issue.</p>
58
59			</summary>
60
61	niq	724959	<section id="security"><title>Security Considerations</title>
62	niq	771733
63			<p><module>mod_privileges</module> introduces new security concerns
64			in situations where <strong>untrusted code</strong> may be run
65			<strong>within the webserver process</strong>. This applies to
66			untrusted modules, and scripts running under modules such as
67			mod_php or mod_perl. Scripts running externally (e.g. as CGI
68			or in an appserver behind mod_proxy or mod_jk) are NOT affected.</p>
69
70			<p>The basic security concerns with mod_privileges are:</p>
71	niq	724959	<ul><li>Running as a system user introduces the same security issues
72			as mod_suexec, and near-equivalents such as cgiwrap and suphp.</li>
73			<li>A privileges-aware malicious user extension (module or script)
74			could escalate its privileges to anything available to the
75	niq	771733	httpd process in any virtual host. This introduces new risks
76			if (and only if) mod_privileges is compiled with the
77			<var>BIG_SECURITY_HOLE</var> option.</li>
78	niq	724959	<li>A privileges-aware malicious user extension (module or script)
79	niq	771733	could escalate privileges to set its user ID to another system
80			user (and/or group).</li>
81	niq	724959	</ul>
82
83	niq	771733	<p>The <directive>PrivilegesMode</directive> directive allows you to
84			select either <var>FAST</var> or <var>SECURE</var> mode. You can
85			mix modes, using <var>FAST</var> mode for trusted users and
86			fully-audited code paths, while imposing SECURE mode where an
87			untrusted user has scope to introduce code.</p>
88			<p>Before describing the modes, we should also introduce the target
89			use cases: Benign vs Hostile. In a benign situation, you want to
90			separate users for their convenience, and protect them and the server
91			against the risks posed by honest mistakes, but you trust your users
92			are not deliberately subverting system security. In a hostile
93			situation - e.g. commercial hosting - you may have users deliberately
94			attacking the system or each other.</p>
95			<dl>
96			<dt>FAST mode</dt>
97			<dd>In <var>FAST</var> mode, requests are run in-process with the
98			selected uid/gid and privileges, so the overhead is negligible.
99			This is suitable for benign situations, but is not secure against an
100			attacker escalating privileges with an in-process module or script.</dd>
101			<dt>SECURE mode</dt>
102			<dd>A request in <var>SECURE</var> mode forks a subprocess, which
103			then drops privileges. This is a very similar case to running CGI
104			with suexec, but for the entire request cycle, and with the benefit
105			of fine-grained control of privileges.</dd>
106			</dl>
107			<p>You can select different <directive>PrivilegesMode</directive>s for
108			each virtual host, and even in a directory context within a virtual
109			host. <var>FAST</var> mode is appropriate where the user(s) are
110			trusted and/or have no privilege to load in-process code.
111			<var>SECURE</var> mode is appropriate to cases where untrusted code
112			might be run in-process. However, even in <var>SECURE</var> mode,
113			there is no protection against a malicious user who is able to
114			introduce privileges-aware code running <em>before the start of the
115			request-processing cycle.</em></p>
116	niq	724959
117			</section>
118	niq	771733	<directivesynopsis>
119			<name>PrivilegesMode</name>
120			<description>Trade off processing speed and efficiency vs security against
121			malicious privileges-aware code.</description>
122			<syntax>PrivilegesMode FAST\|SECURE\|SELECTIVE</syntax>
123			<contextlist>
124			<context>server config</context>
125			<context>virtual host</context>
126			<context>directory</context>
127			</contextlist>
128			<compatibility>Available on Solaris 10 and OpenSolaris with
129			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
130			<usage><p>This directive trades off performance vs security against
131			malicious, privileges-aware code. In <var>SECURE</var> mode, each request
132			runs in a secure subprocess, incurring a substantial performance penalty.
133			In <var>FAST</var> mode, the server is not protected against escalation
134			of privileges as discussed above.</p>
135			<p>This directive differs slightly between a <code><Directory></code>
136			context (including equivalents such as Location/Files/If) and a
137			top-level or <code><VirtualHost></code>.</p>
138			<p>At top-level, it sets a default that will be inherited by virtualhosts.
139			In a virtual host, FAST or SECURE mode acts on the entire
140			HTTP request, and any settings in a <code><Directory></code>
141			context will be <strong>ignored</strong>. A third pseudo-mode
142			SELECTIVE defers the choice of FAST vs SECURE to directives in a
143			<code><Directory></code> context.</p>
144			<p>In a <code><Directory></code> context, it is applicable only
145			where SELECTIVE mode was set for the VirtualHost. Only
146			FAST or SECURE can be set in this context (SELECTIVE would be
147			meaningless).</p>
148			<note type="warning"><title>Warning</title>
149			Where SELECTIVE mode is selected for a virtual host, the activation
150			of privileges must be deferred until <em>after</em> the mapping
151			phase of request processing has determined what
152			<code><Directory></code> context applies to the request.
153			This might give an attacker opportunities to introduce
154			code through a <directive module="mod_rewrite">RewriteMap</directive>
155			running at top-level or <code><VirtualHost></code> context
156			<em>before</em> privileges have been dropped and userid/gid set.
157			</note>
158			</usage>
159			</directivesynopsis>
160	niq	724959
161	niq	713961	<directivesynopsis>
162			<name>VHostUser</name>
163			<description>Sets the User ID under which a virtual host runs.</description>
164			<syntax>VHostUser <var>unix-userid</var></syntax>
165			<default>Inherits the userid specified in
166			<directive module="mod_unixd">User</directive></default>
167			<contextlist><context>virtual host</context></contextlist>
168			<compatibility>Available on Solaris 10 and OpenSolaris with
169			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
170
171			<usage>
172			<p>The <directive>VHostUser</directive> directive sets the Unix userid
173			under which the server will process requests to a virtualhost.
174			The userid is set before the request is processed and reset afterwards
175			using <a
176			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
177			>Solaris Privileges</a>. Since the setting applies to the
178			<em>process</em>, this is not compatible with threaded MPMs.</p>
179			<p><var>Unix-userid</var> is one of:</p>
180			<dl>
181			<dt>A username</dt>
182			<dd>Refers to the given user by name.</dd>
183
184			<dt><code>#</code> followed by a user number.</dt>
185			<dd>Refers to a user by its number.</dd>
186			</dl>
187
188			<note type="warning"><title>Security</title>
189			<p>This directive cannot be used to run apache as root!
190			Nevertheless, it opens potential security issues similar to
191			those discussed in the <a href="../suexec.html">suexec</a>
192			documentation.</p></note>
193			</usage>
194			<seealso><directive module="mod_unixd">User</directive></seealso>
195			<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
196			</directivesynopsis>
197
198			<directivesynopsis>
199			<name>VHostGroup</name>
200			<description>Sets the Group ID under which a virtual host runs.</description>
201			<syntax>VHostGroup <var>unix-groupid</var></syntax>
202			<default>Inherits the group id specified in
203			<directive module="mod_unixd">Group</directive></default>
204			<contextlist><context>virtual host</context></contextlist>
205			<compatibility>Available on Solaris 10 and OpenSolaris with
206			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
207
208			<usage>
209			<p>The <directive>VHostGroup</directive> directive sets the Unix group
210			under which the server will process requests to a virtualhost.
211			The group is set before the request is processed and reset afterwards
212			using <a
213			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
214			>Solaris Privileges</a>. Since the setting applies to the
215			<em>process</em>, this is not compatible with threaded MPMs.</p>
216			<p><var>Unix-group</var> is one of:</p>
217			<dl>
218			<dt>A group name</dt>
219			<dd>Refers to the given group by name.</dd>
220
221			<dt><code>#</code> followed by a group number.</dt>
222			<dd>Refers to a group by its number.</dd>
223			</dl>
224
225			<note type="warning"><title>Security</title>
226			<p>This directive cannot be used to run apache as root!
227			Nevertheless, it opens potential security issues similar to
228			those discussed in the <a href="../suexec.html">suexec</a>
229			documentation.</p></note>
230			</usage>
231			<seealso><directive module="mod_unixd">Group</directive></seealso>
232			<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
233			</directivesynopsis>
234
235			<directivesynopsis>
236			<name>VHostSecure</name>
237			<description>Determines whether the server runs with enhanced security
238			for the virtualhost.</description>
239			<syntax>VHostSecure On\|Off</syntax>
240			<default>VHostSecure On</default>
241			<contextlist><context>virtual host</context></contextlist>
242			<compatibility>Available on Solaris 10 and OpenSolaris with
243			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
244
245			<usage>
246			<p>Determines whether the virtual host processes requests with
247			security enhanced by removal of <a
248			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
249			>Privileges</a> that are rarely needed in a webserver, but which are
250			available by default to a normal Unix user and may therefore
251			be required by modules and applications. It is recommended that
252			you retain the default (On) unless it prevents an application running.
253			Since the setting applies to the <em>process</em>, this is not
254			compatible with threaded MPMs.</p>
255			<note><title>Note</title>
256			<p>If <directive>VHostSecure</directive> prevents an application
257			running, this may be a warning sign that the application should be
258			reviewed for security.</p></note>
259			</usage>
260			</directivesynopsis>
261
262			<directivesynopsis>
263			<name>VHostCGIMode</name>
264			<description>Determines whether the virtualhost can run
265			subprocesses, and the privileges available to subprocesses.</description>
266			<syntax>VHostCGIMode On\|Off\|Secure</syntax>
267			<default>VHostCGIMode On</default>
268			<contextlist><context>virtual host</context></contextlist>
269			<compatibility>Available on Solaris 10 and OpenSolaris with
270			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
271
272			<usage>
273			<p>Determines whether the virtual host is allowed to run fork and exec,
274			the <a
275			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
276			>privileges</a> required to run subprocesses. If this is set to
277			<var>Off</var> the virtualhost is denied the privileges and will not
278			be able to run traditional CGI programs or scripts under the traditional
279			<module>mod_cgi</module>, nor similar external programs such as those
280			created by <module>mod_ext_filter</module> or
281			<directive module="mod_rewrite">RewriteMap</directive> <var>prog</var>.
282			Note that it does not prevent CGI programs running under alternative
283			process and security models such as <a href="http://fastcgi.coremail.cn"
284			>mod_fcgid</a>, which is a recommended solution in Solaris.</p>
285			<p>If set to <var>On</var> or <var>Secure</var>, the virtual host
286			is permitted to run external programs and scripts as above.
287			Setting <directive>VHostCGIMode</directive> <var>Secure</var> has
288			the effect of denying privileges to the subprocesses, as described
289			for <directive>VHostSecure</directive>.</p>
290			</usage>
291			</directivesynopsis>
292
293			<directivesynopsis>
294			<name>DTracePrivileges</name>
295			<description>Determines whether the privileges required by dtrace are enabled.</description>
296			<syntax>DTracePrivileges On\|Off</syntax>
297			<default>DTracePrivileges Off</default>
298			<contextlist><context>server config</context></contextlist>
299			<compatibility>Available on Solaris 10 and OpenSolaris with
300			non-threaded MPMs (<module>prefork</module> or custom MPM).</compatibility>
301
302			<usage>
303			<p>This server-wide directive determines whether Apache will run with
304			the <a
305			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
306			>privileges</a> required to run
307			<a href="http://www.sun.com/bigadmin/content/dtrace/">dtrace</a>.
308			Note that <var>DTracePrivileges On</var> will not in itself
309			activate DTrace, but <var>DTracePrivileges Off</var> will prevent
310			it working.</p>
311			</usage>
312			</directivesynopsis>
313
314			<directivesynopsis>
315			<name>VHostPrivs</name>
316			<description>Assign arbitrary privileges to a virtual host.</description>
317			<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
318			<default>None</default>
319			<contextlist><context>virtual host</context></contextlist>
320			<compatibility>Available on Solaris 10 and OpenSolaris with
321	lgentis	765672	non-threaded MPMs (<module>prefork</module> or custom MPM)
322	niq	713961	and when <module>mod_privileges</module> is compiled with the
323			<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>
324
325			<usage>
326			<p><directive>VHostPrivs</directive> can be used to assign arbitrary <a
327			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
328			>privileges</a> to a virtual host. Each <var>privilege-name</var>
329			is the name of a Solaris privilege, such as <var>file_setid</var>
330			or <var>sys_nfs</var>.</p>
331
332			<p>A <var>privilege-name</var> may optionally be prefixed by
333			+ or -, which will respectively allow or deny a privilege.
334			If used with neither + nor -, all privileges otherwise assigned
335			to the virtualhost will be denied. You can use this to override
336			any of the default sets and construct your own privilege set.</p>
337
338			<note type="warning"><title>Security</title>
339			<p>This directive can open huge security holes in apache, up to
340			and including running requests with root-level powers. Do not
341			use it unless you fully understand what you are doing!</p></note>
342			</usage>
343			</directivesynopsis>
344
345			<directivesynopsis>
346			<name>VHostCGIPrivs</name>
347			<description>Assign arbitrary privileges to subprocesses created
348			by a virtual host.</description>
349			<syntax>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</syntax>
350			<default>None</default>
351			<contextlist><context>virtual host</context></contextlist>
352			<compatibility>Available on Solaris 10 and OpenSolaris with
353			non-threaded MPMs (<module>prefork</module> or custom MPM)
354			and when <module>mod_privileges</module> is compiled with the
355			<var>BIG_SECURITY_HOLE</var> compile-time option.</compatibility>
356
357			<usage>
358			<p><directive>VHostCGIPrivs</directive> can be used to assign arbitrary <a
359			href="http://www.sun.com/bigadmin/features/articles/least_privilege.jsp"
360			>privileges</a> to subprocesses created by a virtual host, as discussed
361			under <directive>VHostCGIMode</directive>. Each <var>privilege-name</var>
362			is the name of a Solaris privilege, such as <var>file_setid</var>
363			or <var>sys_nfs</var>.</p>
364
365			<p>A <var>privilege-name</var> may optionally be prefixed by
366			+ or -, which will respectively allow or deny a privilege.
367			If used with neither + nor -, all privileges otherwise assigned
368			to the virtualhost will be denied. You can use this to override
369			any of the default sets and construct your own privilege set.</p>
370
371			<note type="warning"><title>Security</title>
372			<p>This directive can open huge security holes in apache subprocesses,
373			up to and including running them with root-level powers. Do not
374			use it unless you fully understand what you are doing!</p></note>
375			</usage>
376			</directivesynopsis>
377
378
379
380			</modulesynopsis>