1

I have a Apache module that acts as a security filter that allows requests to pass or not. This is a custom made module, I don't want to use any existent module.

I have actually two questions:

  1. The module has its own log file. I'm thinking that the best location should be in /var/log/apache2/ but since the Apache process runs on www-data user, it cannot create files on that path. I want to find a solution for the log file in such way that is not much intrusive (in terms of security) for a typical web server. Where would be the best place and what kind of security attributes should be set?

  2. The module communicates with another process using pipes. I would like to spawn this process from Apache module only when I need it. Where should I locate this binary and how should I set the privileges as less intrusive as possible?

Thanks, Cezane.

cezane
  • 23
  • 3

1 Answers1

1

Apache starts under the superuser first and performs the module initialization (calling the module_struct::register_hooks function). There you can create the log files and either chown them to www-data or keep the file descriptor open in order to later use it from the forked and setuided worker processes.

(And if you need an alternative, I think it's also possible to log with syslog and configure it to route your log messages to your log file).

Under the worker process you are already running as the www-data user so there isn't much you can do to further secure the execution. For example, AFAIK, you can't setuid to yet another user or chroot to protect the filesystem.

What you can do to improve the security is to use a system firewall. For example, under AppArmor you could tell the operating system what binaries your Apache module can execute, stopping it from executing any unwanted binaries. And you can limit that binary's filesystem access, preventing it from accessing www-data files that doesn't belong to it.

ArtemGr
  • 11,684
  • 3
  • 52
  • 85
  • I forgot that firstly Apache starts as root. And I though register_hooks (especially child_init) is called after the fork in order to initialize the module. I'll check this out. Thanks a lot for the hint! – cezane Aug 07 '14 at 14:23
  • Yeah, the function registered with `ap_hook_child_init` runs after `setuid`, but the `register_hooks` function runs as `root`. – ArtemGr Aug 07 '14 at 15:09