0

I see here: https://httpd.apache.org/docs/current/invoking.html

"If the Listen specified in the configuration file is default of 80 (or any other port below 1024), then it is necessary to have root privileges in order to start apache, so that it can bind to this privileged port.

Once the server has started and performed a few preliminary activities such as opening its log files, it will launch several child processes which do the work of listening for and answering requests from clients. The main httpd process continues to run as the root user, but the child processes run as a less privileged user. "

Question is: How can a child process do so? The incoming request happens on port 80 which the master is now bound to.

I am guessing the master process will call the bind() call and the child can then do a listen() call against the bound socket? Or Does the master server pass the children the incoming data?

jouell
  • 621
  • 1
  • 5
  • 20
  • Side note: Don't believe everything you read. Apache's documentation is actually slightly outdated. Modern OS'es (like Solaris) no longer require root account to able to bind to port <1024. Instead they follow the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) which is a lot safer approach. So for example on Solaris you would *only* assign the `net_privaddr` privilege for this to work which is a very narrow privilege (compared to giving him root privs). – peterh Jun 25 '16 at 08:45

1 Answers1

0

First per: https://httpd.apache.org/docs/current/invoking.html

  1. The children inherits the socket

covener says "Normally the listening socket is inherited by the children when they're forked. They can either all try to call accept on it, or they can fight over a mutex and let one get into accept()"

Next,

  1. I found truss output for Solaris of a child process

http://httpd.apache.org/docs/current/misc/perf-tuning.html

It also says: "...upon accepting the connection, the listener thread wakes up a worker thread to do the request processing."

For completeness, since it's a listener process I'll assume it already did listen(). That call is not in the truss output above.

jouell
  • 621
  • 1
  • 5
  • 20