passenger 2.2.7 → 2.2.8
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of passenger might be problematic. Click here for more details.
- data/NEWS +40 -0
- data/Rakefile +1 -1
- data/bin/passenger-install-apache2-module +1 -0
- data/bin/passenger-install-nginx-module +2 -0
- data/doc/Architectural overview.html +173 -138
- data/doc/Security of user switching support.html +147 -109
- data/doc/Users guide Apache.html +4 -43
- data/doc/Users guide Nginx.html +4 -43
- data/doc/cxxapi/Bucket_8h-source.html +1 -1
- data/doc/cxxapi/Configuration_8h-source.html +1 -1
- data/doc/cxxapi/DirectoryMapper_8h-source.html +1 -1
- data/doc/cxxapi/Hooks_8h-source.html +1 -1
- data/doc/cxxapi/annotated.html +1 -1
- data/doc/cxxapi/classHooks-members.html +1 -1
- data/doc/cxxapi/classHooks.html +1 -1
- data/doc/cxxapi/classPassenger_1_1DirectoryMapper-members.html +1 -1
- data/doc/cxxapi/classPassenger_1_1DirectoryMapper.html +1 -1
- data/doc/cxxapi/classes.html +1 -1
- data/doc/cxxapi/definitions_8h-source.html +1 -1
- data/doc/cxxapi/files.html +1 -1
- data/doc/cxxapi/functions.html +1 -1
- data/doc/cxxapi/functions_func.html +1 -1
- data/doc/cxxapi/graph_legend.html +1 -1
- data/doc/cxxapi/group__Configuration.html +1 -1
- data/doc/cxxapi/group__Core.html +1 -1
- data/doc/cxxapi/group__Hooks.html +1 -1
- data/doc/cxxapi/group__Support.html +1 -1
- data/doc/cxxapi/main.html +1 -1
- data/doc/cxxapi/modules.html +1 -1
- data/doc/rdoc/classes/GC.html +4 -4
- data/doc/rdoc/classes/PhusionPassenger.html +2 -1
- data/doc/rdoc/classes/PhusionPassenger/AbstractInstaller.html +8 -8
- data/doc/rdoc/classes/PhusionPassenger/AbstractRequestHandler.html +26 -26
- data/doc/rdoc/classes/PhusionPassenger/AbstractServer.html +98 -98
- data/doc/rdoc/classes/PhusionPassenger/AbstractServerCollection.html +61 -61
- data/doc/rdoc/classes/PhusionPassenger/AppInitError.html +4 -4
- data/doc/rdoc/classes/PhusionPassenger/Application.html +14 -14
- data/doc/rdoc/classes/PhusionPassenger/ConsoleTextTemplate.html +12 -12
- data/doc/rdoc/classes/PhusionPassenger/FrameworkInitError.html +4 -4
- data/doc/rdoc/classes/PhusionPassenger/HTMLTemplate.html +12 -12
- data/doc/rdoc/classes/PhusionPassenger/InitializationError.html +5 -5
- data/doc/rdoc/classes/PhusionPassenger/MessageChannel.html +42 -42
- data/doc/rdoc/classes/PhusionPassenger/Rack/ApplicationSpawner.html +33 -33
- data/doc/rdoc/classes/PhusionPassenger/Rack/RequestHandler.html +59 -59
- data/doc/rdoc/classes/PhusionPassenger/Railz/ApplicationSpawner.html +3 -3
- data/doc/rdoc/classes/PhusionPassenger/Railz/FrameworkSpawner.html +7 -7
- data/doc/rdoc/classes/PhusionPassenger/SpawnManager.html +23 -23
- data/doc/rdoc/classes/PhusionPassenger/UnknownError.html +4 -4
- data/doc/rdoc/classes/PhusionPassenger/Utils.html +2 -0
- data/doc/rdoc/classes/PhusionPassenger/Utils/PseudoIO.html +16 -16
- data/doc/rdoc/classes/PhusionPassenger/VersionNotFound.html +4 -4
- data/doc/rdoc/classes/PlatformInfo.html +1 -1
- data/doc/rdoc/classes/Signal.html +23 -15
- data/doc/rdoc/created.rid +1 -1
- data/doc/rdoc/files/DEVELOPERS_TXT.html +1 -1
- data/doc/rdoc/files/README.html +1 -1
- data/doc/rdoc/files/ext/phusion_passenger/native_support_c.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/abstract_installer_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/abstract_request_handler_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/abstract_server_collection_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/abstract_server_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/admin_tools/control_process_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/admin_tools_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/application_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/console_text_template_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/constants_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/dependencies_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/events_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/exceptions_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/html_template_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/message_channel_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/packaging_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/platform_info_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/rack/application_spawner_rb.html +2 -2
- data/doc/rdoc/files/lib/phusion_passenger/rack/request_handler_rb.html +2 -2
- data/doc/rdoc/files/lib/phusion_passenger/railz/application_spawner_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/railz/cgi_fixed_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/railz/framework_spawner_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/railz/request_handler_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/simple_benchmarking_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/spawn_manager_rb.html +1 -1
- data/doc/rdoc/files/lib/phusion_passenger/utils_rb.html +9 -9
- data/doc/rdoc/files/lib/phusion_passenger/wsgi/application_spawner_rb.html +1 -1
- data/doc/rdoc/files/misc/rake/extensions_rb.html +1 -1
- data/doc/rdoc/fr_class_index.html +2 -0
- data/doc/rdoc/fr_file_index.html +1 -0
- data/doc/rdoc/fr_method_index.html +79 -72
- data/ext/apache2/Hooks.cpp +4 -2
- data/ext/common/StandardApplicationPool.h +4 -2
- data/ext/common/Version.h +1 -1
- data/ext/nginx/Configuration.c +1 -1
- data/ext/oxt/system_calls.cpp +11 -0
- data/ext/oxt/system_calls.hpp +2 -1
- data/ext/oxt/thread.hpp +97 -1
- data/lib/phusion_passenger/constants.rb +1 -1
- data/lib/phusion_passenger/dependencies.rb +32 -0
- data/lib/phusion_passenger/platform_info.rb +1 -1
- data/lib/phusion_passenger/rack/application_spawner.rb +4 -4
- data/lib/phusion_passenger/rack/request_handler.rb +2 -5
- data/lib/phusion_passenger/railz/application_spawner.rb +13 -2
- data/lib/phusion_passenger/utils.rb +12 -4
- data/{vendor/rack-1.0.0-git/lib/rack → lib/phusion_passenger/utils}/rewindable_input.rb +19 -3
- data/test/ApplicationPoolTest.cpp +1 -1
- metadata +13 -59
- data/vendor/README +0 -13
- data/vendor/README_FOR_PACKAGERS +0 -1
- data/vendor/rack-1.0.0-git/COPYING +0 -18
- data/vendor/rack-1.0.0-git/KNOWN-ISSUES +0 -18
- data/vendor/rack-1.0.0-git/README +0 -353
- data/vendor/rack-1.0.0-git/Rakefile +0 -164
- data/vendor/rack-1.0.0-git/lib/rack.rb +0 -90
- data/vendor/rack-1.0.0-git/lib/rack/adapter/camping.rb +0 -22
- data/vendor/rack-1.0.0-git/lib/rack/auth/abstract/handler.rb +0 -37
- data/vendor/rack-1.0.0-git/lib/rack/auth/abstract/request.rb +0 -37
- data/vendor/rack-1.0.0-git/lib/rack/auth/basic.rb +0 -58
- data/vendor/rack-1.0.0-git/lib/rack/auth/digest/md5.rb +0 -124
- data/vendor/rack-1.0.0-git/lib/rack/auth/digest/nonce.rb +0 -51
- data/vendor/rack-1.0.0-git/lib/rack/auth/digest/params.rb +0 -55
- data/vendor/rack-1.0.0-git/lib/rack/auth/digest/request.rb +0 -40
- data/vendor/rack-1.0.0-git/lib/rack/auth/openid.rb +0 -487
- data/vendor/rack-1.0.0-git/lib/rack/builder.rb +0 -63
- data/vendor/rack-1.0.0-git/lib/rack/cascade.rb +0 -41
- data/vendor/rack-1.0.0-git/lib/rack/chunked.rb +0 -49
- data/vendor/rack-1.0.0-git/lib/rack/commonlogger.rb +0 -52
- data/vendor/rack-1.0.0-git/lib/rack/conditionalget.rb +0 -47
- data/vendor/rack-1.0.0-git/lib/rack/content_length.rb +0 -29
- data/vendor/rack-1.0.0-git/lib/rack/content_type.rb +0 -23
- data/vendor/rack-1.0.0-git/lib/rack/deflater.rb +0 -96
- data/vendor/rack-1.0.0-git/lib/rack/directory.rb +0 -153
- data/vendor/rack-1.0.0-git/lib/rack/file.rb +0 -88
- data/vendor/rack-1.0.0-git/lib/rack/handler.rb +0 -69
- data/vendor/rack-1.0.0-git/lib/rack/handler/cgi.rb +0 -61
- data/vendor/rack-1.0.0-git/lib/rack/handler/evented_mongrel.rb +0 -8
- data/vendor/rack-1.0.0-git/lib/rack/handler/fastcgi.rb +0 -88
- data/vendor/rack-1.0.0-git/lib/rack/handler/lsws.rb +0 -55
- data/vendor/rack-1.0.0-git/lib/rack/handler/mongrel.rb +0 -84
- data/vendor/rack-1.0.0-git/lib/rack/handler/scgi.rb +0 -59
- data/vendor/rack-1.0.0-git/lib/rack/handler/swiftiplied_mongrel.rb +0 -8
- data/vendor/rack-1.0.0-git/lib/rack/handler/thin.rb +0 -18
- data/vendor/rack-1.0.0-git/lib/rack/handler/webrick.rb +0 -67
- data/vendor/rack-1.0.0-git/lib/rack/head.rb +0 -19
- data/vendor/rack-1.0.0-git/lib/rack/lint.rb +0 -537
- data/vendor/rack-1.0.0-git/lib/rack/lobster.rb +0 -65
- data/vendor/rack-1.0.0-git/lib/rack/lock.rb +0 -16
- data/vendor/rack-1.0.0-git/lib/rack/methodoverride.rb +0 -27
- data/vendor/rack-1.0.0-git/lib/rack/mime.rb +0 -204
- data/vendor/rack-1.0.0-git/lib/rack/mock.rb +0 -184
- data/vendor/rack-1.0.0-git/lib/rack/recursive.rb +0 -57
- data/vendor/rack-1.0.0-git/lib/rack/reloader.rb +0 -106
- data/vendor/rack-1.0.0-git/lib/rack/request.rb +0 -248
- data/vendor/rack-1.0.0-git/lib/rack/response.rb +0 -183
- data/vendor/rack-1.0.0-git/lib/rack/session/abstract/id.rb +0 -142
- data/vendor/rack-1.0.0-git/lib/rack/session/cookie.rb +0 -91
- data/vendor/rack-1.0.0-git/lib/rack/session/memcache.rb +0 -109
- data/vendor/rack-1.0.0-git/lib/rack/session/pool.rb +0 -100
- data/vendor/rack-1.0.0-git/lib/rack/showexceptions.rb +0 -349
- data/vendor/rack-1.0.0-git/lib/rack/showstatus.rb +0 -106
- data/vendor/rack-1.0.0-git/lib/rack/static.rb +0 -38
- data/vendor/rack-1.0.0-git/lib/rack/urlmap.rb +0 -55
- data/vendor/rack-1.0.0-git/lib/rack/utils.rb +0 -522
|
@@ -3,7 +3,8 @@
|
|
|
3
3
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
|
4
4
|
<head>
|
|
5
5
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
|
6
|
-
<meta name="generator" content="AsciiDoc 8.2
|
|
6
|
+
<meta name="generator" content="AsciiDoc 8.4.2" />
|
|
7
|
+
<title>Security of user switching support in Passenger</title>
|
|
7
8
|
<style type="text/css">
|
|
8
9
|
/* Debug borders */
|
|
9
10
|
p, li, dt, dd, div, pre, h1, h2, h3, h4, h5, h6 {
|
|
@@ -26,10 +27,12 @@ a:visited {
|
|
|
26
27
|
|
|
27
28
|
em {
|
|
28
29
|
font-style: italic;
|
|
30
|
+
color: navy;
|
|
29
31
|
}
|
|
30
32
|
|
|
31
33
|
strong {
|
|
32
34
|
font-weight: bold;
|
|
35
|
+
color: #083194;
|
|
33
36
|
}
|
|
34
37
|
|
|
35
38
|
tt {
|
|
@@ -71,6 +74,10 @@ p {
|
|
|
71
74
|
margin-bottom: 0.5em;
|
|
72
75
|
}
|
|
73
76
|
|
|
77
|
+
ul, ol, li > p {
|
|
78
|
+
margin-top: 0;
|
|
79
|
+
}
|
|
80
|
+
|
|
74
81
|
pre {
|
|
75
82
|
padding: 0;
|
|
76
83
|
margin: 0;
|
|
@@ -104,11 +111,13 @@ div#footer-badges {
|
|
|
104
111
|
padding-bottom: 0.5em;
|
|
105
112
|
}
|
|
106
113
|
|
|
107
|
-
div#preamble
|
|
114
|
+
div#preamble {
|
|
115
|
+
margin-top: 1.5em;
|
|
116
|
+
margin-bottom: 1.5em;
|
|
117
|
+
}
|
|
108
118
|
div.tableblock, div.imageblock, div.exampleblock, div.verseblock,
|
|
109
119
|
div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
|
|
110
120
|
div.admonitionblock {
|
|
111
|
-
margin-right: 10%;
|
|
112
121
|
margin-top: 1.5em;
|
|
113
122
|
margin-bottom: 1.5em;
|
|
114
123
|
}
|
|
@@ -123,6 +132,7 @@ div.content { /* Block element content. */
|
|
|
123
132
|
|
|
124
133
|
/* Block element titles. */
|
|
125
134
|
div.title, caption.title {
|
|
135
|
+
color: #527bbd;
|
|
126
136
|
font-family: sans-serif;
|
|
127
137
|
font-weight: bold;
|
|
128
138
|
text-align: left;
|
|
@@ -149,22 +159,33 @@ div.sidebarblock > div.content {
|
|
|
149
159
|
padding: 0.5em;
|
|
150
160
|
}
|
|
151
161
|
|
|
152
|
-
div.listingblock {
|
|
153
|
-
margin-right: 0%;
|
|
154
|
-
}
|
|
155
162
|
div.listingblock > div.content {
|
|
156
163
|
border: 1px solid silver;
|
|
157
164
|
background: #f4f4f4;
|
|
158
165
|
padding: 0.5em;
|
|
159
166
|
}
|
|
160
167
|
|
|
161
|
-
div.quoteblock
|
|
168
|
+
div.quoteblock {
|
|
162
169
|
padding-left: 2.0em;
|
|
170
|
+
margin-right: 10%;
|
|
163
171
|
}
|
|
164
|
-
|
|
165
|
-
|
|
172
|
+
div.quoteblock > div.attribution {
|
|
173
|
+
padding-top: 0.5em;
|
|
166
174
|
text-align: right;
|
|
167
175
|
}
|
|
176
|
+
|
|
177
|
+
div.verseblock {
|
|
178
|
+
padding-left: 2.0em;
|
|
179
|
+
margin-right: 10%;
|
|
180
|
+
}
|
|
181
|
+
div.verseblock > div.content {
|
|
182
|
+
white-space: pre;
|
|
183
|
+
}
|
|
184
|
+
div.verseblock > div.attribution {
|
|
185
|
+
padding-top: 0.75em;
|
|
186
|
+
text-align: left;
|
|
187
|
+
}
|
|
188
|
+
/* DEPRECATED: Pre version 8.2.7 verse style literal block. */
|
|
168
189
|
div.verseblock + div.attribution {
|
|
169
190
|
text-align: left;
|
|
170
191
|
}
|
|
@@ -187,10 +208,6 @@ div.exampleblock > div.content {
|
|
|
187
208
|
padding: 0.5em;
|
|
188
209
|
}
|
|
189
210
|
|
|
190
|
-
div.verseblock div.content {
|
|
191
|
-
white-space: pre;
|
|
192
|
-
}
|
|
193
|
-
|
|
194
211
|
div.imageblock div.content { padding-left: 0; }
|
|
195
212
|
div.imageblock img { border: 1px solid silver; }
|
|
196
213
|
span.image img { border-style: none; }
|
|
@@ -202,18 +219,38 @@ dl {
|
|
|
202
219
|
dt {
|
|
203
220
|
margin-top: 0.5em;
|
|
204
221
|
margin-bottom: 0;
|
|
205
|
-
font-style:
|
|
222
|
+
font-style: normal;
|
|
223
|
+
color: navy;
|
|
206
224
|
}
|
|
207
225
|
dd > *:first-child {
|
|
208
|
-
margin-top: 0;
|
|
226
|
+
margin-top: 0.1em;
|
|
209
227
|
}
|
|
210
228
|
|
|
211
229
|
ul, ol {
|
|
212
230
|
list-style-position: outside;
|
|
213
231
|
}
|
|
214
|
-
|
|
232
|
+
ol.arabic {
|
|
233
|
+
list-style-type: decimal;
|
|
234
|
+
}
|
|
235
|
+
ol.loweralpha {
|
|
215
236
|
list-style-type: lower-alpha;
|
|
216
237
|
}
|
|
238
|
+
ol.upperalpha {
|
|
239
|
+
list-style-type: upper-alpha;
|
|
240
|
+
}
|
|
241
|
+
ol.lowerroman {
|
|
242
|
+
list-style-type: lower-roman;
|
|
243
|
+
}
|
|
244
|
+
ol.upperroman {
|
|
245
|
+
list-style-type: upper-roman;
|
|
246
|
+
}
|
|
247
|
+
|
|
248
|
+
div.compact ul, div.compact ol,
|
|
249
|
+
div.compact p, div.compact p,
|
|
250
|
+
div.compact div, div.compact div {
|
|
251
|
+
margin-top: 0.1em;
|
|
252
|
+
margin-bottom: 0.1em;
|
|
253
|
+
}
|
|
217
254
|
|
|
218
255
|
div.tableblock > table {
|
|
219
256
|
border: 3px solid #527bbd;
|
|
@@ -225,22 +262,53 @@ thead {
|
|
|
225
262
|
tfoot {
|
|
226
263
|
font-weight: bold;
|
|
227
264
|
}
|
|
265
|
+
td > div.verse {
|
|
266
|
+
white-space: pre;
|
|
267
|
+
}
|
|
268
|
+
p.table {
|
|
269
|
+
margin-top: 0;
|
|
270
|
+
}
|
|
271
|
+
/* Because the table frame attribute is overriden by CSS in most browsers. */
|
|
272
|
+
div.tableblock > table[frame="void"] {
|
|
273
|
+
border-style: none;
|
|
274
|
+
}
|
|
275
|
+
div.tableblock > table[frame="hsides"] {
|
|
276
|
+
border-left-style: none;
|
|
277
|
+
border-right-style: none;
|
|
278
|
+
}
|
|
279
|
+
div.tableblock > table[frame="vsides"] {
|
|
280
|
+
border-top-style: none;
|
|
281
|
+
border-bottom-style: none;
|
|
282
|
+
}
|
|
283
|
+
|
|
228
284
|
|
|
229
|
-
div.
|
|
285
|
+
div.hdlist {
|
|
230
286
|
margin-top: 0.8em;
|
|
231
287
|
margin-bottom: 0.8em;
|
|
232
288
|
}
|
|
233
|
-
div.
|
|
234
|
-
padding-bottom:
|
|
289
|
+
div.hdlist tr {
|
|
290
|
+
padding-bottom: 15px;
|
|
235
291
|
}
|
|
236
|
-
td.
|
|
292
|
+
dt.hdlist1.strong, td.hdlist1.strong {
|
|
293
|
+
font-weight: bold;
|
|
294
|
+
}
|
|
295
|
+
td.hdlist1 {
|
|
237
296
|
vertical-align: top;
|
|
238
|
-
font-style:
|
|
297
|
+
font-style: normal;
|
|
239
298
|
padding-right: 0.8em;
|
|
299
|
+
color: navy;
|
|
240
300
|
}
|
|
241
|
-
td.
|
|
301
|
+
td.hdlist2 {
|
|
242
302
|
vertical-align: top;
|
|
243
303
|
}
|
|
304
|
+
div.hdlist.compact tr {
|
|
305
|
+
margin: 0;
|
|
306
|
+
padding-bottom: 0;
|
|
307
|
+
}
|
|
308
|
+
|
|
309
|
+
.comment {
|
|
310
|
+
background: yellow;
|
|
311
|
+
}
|
|
244
312
|
|
|
245
313
|
@media print {
|
|
246
314
|
div#footer-badges { display: none; }
|
|
@@ -271,37 +339,6 @@ div.toclevel4 {
|
|
|
271
339
|
margin-left: 6em;
|
|
272
340
|
font-size: 0.9em;
|
|
273
341
|
}
|
|
274
|
-
/* Workarounds for IE6's broken and incomplete CSS2. */
|
|
275
|
-
|
|
276
|
-
div.sidebar-content {
|
|
277
|
-
background: #ffffee;
|
|
278
|
-
border: 1px solid silver;
|
|
279
|
-
padding: 0.5em;
|
|
280
|
-
}
|
|
281
|
-
div.sidebar-title, div.image-title {
|
|
282
|
-
font-family: sans-serif;
|
|
283
|
-
font-weight: bold;
|
|
284
|
-
margin-top: 0.0em;
|
|
285
|
-
margin-bottom: 0.5em;
|
|
286
|
-
}
|
|
287
|
-
|
|
288
|
-
div.listingblock div.content {
|
|
289
|
-
border: 1px solid silver;
|
|
290
|
-
background: #f4f4f4;
|
|
291
|
-
padding: 0.5em;
|
|
292
|
-
}
|
|
293
|
-
|
|
294
|
-
div.quoteblock-content {
|
|
295
|
-
padding-left: 2.0em;
|
|
296
|
-
}
|
|
297
|
-
|
|
298
|
-
div.exampleblock-content {
|
|
299
|
-
border-left: 2px solid silver;
|
|
300
|
-
padding-left: 0.5em;
|
|
301
|
-
}
|
|
302
|
-
|
|
303
|
-
/* IE6 sets dynamically generated links as visited. */
|
|
304
|
-
div#toc a:visited { color: blue; }
|
|
305
342
|
</style>
|
|
306
343
|
<script type="text/javascript">
|
|
307
344
|
/*<![CDATA[*/
|
|
@@ -372,10 +409,11 @@ function generateToc(toclevels) {
|
|
|
372
409
|
div.className = "toclevel" + entry.toclevel;
|
|
373
410
|
toc.appendChild(div);
|
|
374
411
|
}
|
|
412
|
+
if (entries.length == 0)
|
|
413
|
+
document.getElementById("header").removeChild(toc);
|
|
375
414
|
}
|
|
376
415
|
/*]]>*/
|
|
377
416
|
</script>
|
|
378
|
-
<title>Security of user switching support in Passenger</title>
|
|
379
417
|
</head>
|
|
380
418
|
<body>
|
|
381
419
|
<div id="header">
|
|
@@ -396,23 +434,23 @@ function generateToc(toclevels) {
|
|
|
396
434
|
<a href="Architectural%20overview.html">Architectural Overview</a>.</td>
|
|
397
435
|
</tr></table>
|
|
398
436
|
</div>
|
|
399
|
-
<div class="
|
|
437
|
+
<div class="paragraph"><p>A straightforward implementation of Passenger will spawn Rails applications in
|
|
400
438
|
the same user context as Apache itself. On server machines which host multiple
|
|
401
439
|
websites for multiple users, this may not be desired. All Rails applications
|
|
402
440
|
spawned by Passenger will be able to read and write to all directories that the
|
|
403
|
-
web server can. So for example, Joe
|
|
404
|
-
Rails application
|
|
441
|
+
web server can. So for example, Joe’s Rails applications could read Jane’s
|
|
442
|
+
Rails application’s <em>database.yml</em> or delete her application files. This is
|
|
405
443
|
also a problem that typically plagues PHP web hosts.</p></div>
|
|
406
|
-
<div class="
|
|
444
|
+
<div class="paragraph"><p>There are multiple ways to solve this problem. The goal of this document is to
|
|
407
445
|
inform the reader about the solutions have we have analyzed, so that
|
|
408
|
-
Passenger
|
|
446
|
+
Passenger’s security may be peer reviewed.</p></div>
|
|
409
447
|
</div>
|
|
410
448
|
<h2 id="_analysis_of_possible_solutions">2. Analysis of possible solutions</h2>
|
|
411
449
|
<div class="sectionbody">
|
|
412
|
-
<div class="
|
|
413
|
-
application server as its owner
|
|
450
|
+
<div class="paragraph"><p>It seems that the only way to solve this problem on Unix, is to run each Rails
|
|
451
|
+
application server as its owner’s user and group. Passenger can make use of
|
|
414
452
|
one of the following methods to implement this:</p></div>
|
|
415
|
-
<div class="olist"><ol>
|
|
453
|
+
<div class="olist arabic"><ol class="arabic">
|
|
416
454
|
<li>
|
|
417
455
|
<p>
|
|
418
456
|
Apache (and thus Passenger) must already be running as root.
|
|
@@ -420,7 +458,7 @@ Apache (and thus Passenger) must already be running as root.
|
|
|
420
458
|
</li>
|
|
421
459
|
<li>
|
|
422
460
|
<p>
|
|
423
|
-
Using Apache
|
|
461
|
+
Using Apache’s suEXEC.
|
|
424
462
|
</p>
|
|
425
463
|
</li>
|
|
426
464
|
<li>
|
|
@@ -446,12 +484,12 @@ Using <em>sudo</em>.
|
|
|
446
484
|
</p>
|
|
447
485
|
</li>
|
|
448
486
|
</ol></div>
|
|
449
|
-
<div class="
|
|
450
|
-
<h3 id="apache_root">2.1. Apache must already be running as root</h3
|
|
451
|
-
<div class="
|
|
487
|
+
<div class="paragraph"><p>Let us take a look at each method in detail.</p></div>
|
|
488
|
+
<h3 id="apache_root">2.1. Apache must already be running as root</h3>
|
|
489
|
+
<div class="paragraph"><p>First, let us take a look at the typical Apache setup, in which Apache is bound
|
|
452
490
|
to port 80, and uses the prefork MPM. Binding to any port lower than 1024
|
|
453
491
|
requires root privileges, so Apache is typically run as root. This poses an
|
|
454
|
-
unacceptable security risk, so Apache
|
|
492
|
+
unacceptable security risk, so Apache’s prefork MPM will, upon receiving an
|
|
455
493
|
HTTP request, spawn a child process with the privileges of a normal user,
|
|
456
494
|
typically <em>www-data</em> or <em>nobody</em>.
|
|
457
495
|
See <a href="http://httpd.apache.org/docs/2.2/mod/prefork.html">the documentation for the
|
|
@@ -459,37 +497,37 @@ prefork MPM</a> - in particular the “User” and “Group” d
|
|
|
459
497
|
The process which is responsible for spawning child processes (also called the
|
|
460
498
|
control process) is run as root. This is also true for
|
|
461
499
|
<a href="http://httpd.apache.org/docs/2.2/mod/worker.html">the worker MPM</a>.</p></div>
|
|
462
|
-
<div class="
|
|
500
|
+
<div class="paragraph"><p>Since Passenger has access to the control process, in the typical Apache setup,
|
|
463
501
|
Passenger can already launch Rails applications as a different user. But now we
|
|
464
502
|
have to ask this question:</p></div>
|
|
465
503
|
<div class="exampleblock">
|
|
466
|
-
<div class="
|
|
467
|
-
<div class="
|
|
504
|
+
<div class="content">
|
|
505
|
+
<div class="paragraph"><p>If Apache is not running as root, are there still any Passenger users who
|
|
468
506
|
want to run Rails applications as different users?</p></div>
|
|
469
507
|
</div></div>
|
|
470
|
-
<div class="
|
|
471
|
-
<div class="
|
|
508
|
+
<div class="paragraph"><p>If the answer is yes, then we cannot use this method.</p></div>
|
|
509
|
+
<div class="paragraph"><p>The advantage of this method is that setting up Apache to run as root is
|
|
472
510
|
incredibly easy, and requires no new framework to be written. However, testing
|
|
473
511
|
this method in automated unit tests will require running the unit test suit as
|
|
474
512
|
root.</p></div>
|
|
475
|
-
<h3 id="
|
|
476
|
-
<div class="
|
|
513
|
+
<h3 id="_using_apache_8217_s_suexec">2.2. Using Apache’s suEXEC</h3>
|
|
514
|
+
<div class="paragraph"><p>Apache’s <a href="http://httpd.apache.org/docs/2.0/suexec.html">suEXEC</a> allows one to
|
|
477
515
|
run CGI processes as different users. But it seems that suEXEC can only be
|
|
478
516
|
used for CGI, and is not a general-purpose mechanism. The
|
|
479
517
|
<a href="http://alain.knaff.lu/howto/PhpSuexec/">PHP-suEXEC</a> software allows one to run
|
|
480
518
|
PHP applications via suEXEC, but it requires patching suEXEC. If Passenger is
|
|
481
|
-
to use suEXEC, then it is likely that we
|
|
519
|
+
to use suEXEC, then it is likely that we’ll have to patch suEXEC. The suEXEC
|
|
482
520
|
website strongly discourages patching.</p></div>
|
|
483
|
-
<h3 id="_using_a_setuid_root_wrapper_application">2.3. Using a setuid root wrapper application</h3
|
|
484
|
-
<div class="
|
|
521
|
+
<h3 id="_using_a_setuid_root_wrapper_application">2.3. Using a setuid root wrapper application</h3>
|
|
522
|
+
<div class="paragraph"><p>If we use this method, we must be extremely careful. It must not be possible
|
|
485
523
|
for arbitrary processes to gain root privileges. We want Passenger, and only
|
|
486
524
|
Passenger, to be able to gain root privileges.</p></div>
|
|
487
|
-
<div class="
|
|
525
|
+
<div class="paragraph"><p>There are multiple ways to implement this security. The first one is to use
|
|
488
526
|
a password file, which only Apache and the wrapper can read, through
|
|
489
527
|
the use of proper file permissions. The password file must never be world
|
|
490
528
|
readable or writable.</p></div>
|
|
491
|
-
<div class="
|
|
492
|
-
<div class="olist"><ol>
|
|
529
|
+
<div class="paragraph"><p>It works as follows:</p></div>
|
|
530
|
+
<div class="olist arabic"><ol class="arabic">
|
|
493
531
|
<li>
|
|
494
532
|
<p>
|
|
495
533
|
Passenger runs the wrapper.
|
|
@@ -511,40 +549,40 @@ The wrapper checks whether the passed content is the same as what is in
|
|
|
511
549
|
</p>
|
|
512
550
|
</li>
|
|
513
551
|
</ol></div>
|
|
514
|
-
<div class="
|
|
552
|
+
<div class="paragraph"><p>An obvious problem that arises is: how does the wrapper locate its own password
|
|
515
553
|
file? We obviously do not want to be able to specify the password filename as
|
|
516
554
|
an argument to the wrapper: that would defeat the point of the password file.
|
|
517
555
|
The solution is that the filename is to be hardcoded into the binary during
|
|
518
556
|
compile time.</p></div>
|
|
519
|
-
<div class="
|
|
557
|
+
<div class="paragraph"><p>Another way to implement security is to use a whitelist of users that are
|
|
520
558
|
allowed to use the wrapper. The wrapper can then check whether the calling
|
|
521
|
-
process
|
|
522
|
-
<div class="
|
|
559
|
+
process’s user is in the whitelist.</p></div>
|
|
560
|
+
<div class="paragraph"><p>Writing a wrapper is not too hard. Furthermore, unit tests do not have to be
|
|
523
561
|
run as root, in contrast to the run-Apache-as-root method.</p></div>
|
|
524
|
-
<h3 id="setuid_root">2.4. Using a setuid $X wrapper application</h3
|
|
525
|
-
<div class="
|
|
562
|
+
<h3 id="setuid_root">2.4. Using a setuid $X wrapper application</h3>
|
|
563
|
+
<div class="paragraph"><p>A setuid $X wrapper will work in a fashion similar to the setuid root wrapper,
|
|
526
564
|
i.e. it will use a password file for authorization.</p></div>
|
|
527
|
-
<div class="
|
|
565
|
+
<div class="paragraph"><p>Passenger does not spawn Rails applications itself, but does so via the spawn
|
|
528
566
|
server. This spawn server is also responsible for preloading the Rails
|
|
529
567
|
framework and the Rails application code, in order to speed up the spawning
|
|
530
568
|
of Rails applications. See the design document of the spawn server for details.
|
|
531
569
|
The spawn server never calls <tt>exec()</tt>: doing so will make preloading useless.
|
|
532
570
|
If Passenger is to use a setuid $X wrapper, then it must start the spawn
|
|
533
571
|
server via the wrapper. The spawn server itself cannot use the wrapper.</p></div>
|
|
534
|
-
<div class="
|
|
572
|
+
<div class="paragraph"><p>However, doing so will make preloading less efficient. Passenger will be forced
|
|
535
573
|
to run a spawn server for each user. The different spawn servers do not share
|
|
536
574
|
memory with each other, so a lot of memory is wasted compared to the other
|
|
537
575
|
methods.</p></div>
|
|
538
|
-
<div class="
|
|
576
|
+
<div class="paragraph"><p>Implementing this will also take more work. One has to create a different
|
|
539
577
|
wrapper for each user, and to install it.</p></div>
|
|
540
|
-
<h3 id="_using_em_su_em">2.5. Using <em>su</em></h3
|
|
541
|
-
<div class="
|
|
578
|
+
<h3 id="_using_em_su_em">2.5. Using <em>su</em></h3>
|
|
579
|
+
<div class="paragraph"><p>The standard Unix <em>su</em> tool asks for the root password. It’s a bad idea for
|
|
542
580
|
Apache to know the root password, so using <em>su</em> is not a viable alternative.</p></div>
|
|
543
|
-
<h3 id="_using_em_sudo_em">2.6. Using <em>sudo</em></h3
|
|
544
|
-
<div class="
|
|
581
|
+
<h3 id="_using_em_sudo_em">2.6. Using <em>sudo</em></h3>
|
|
582
|
+
<div class="paragraph"><p>It might be possible to use the <em>sudo</em> utility. sudo can be configured in
|
|
545
583
|
such a way that the user Apache runs as can use sudo without having to enter a
|
|
546
584
|
password.</p></div>
|
|
547
|
-
<div class="
|
|
585
|
+
<div class="paragraph"><p>However, Passenger uses an anonymous communication channel (an unnamed Unix
|
|
548
586
|
socket) to communicate with the spawn server. sudo seems to close all file
|
|
549
587
|
descriptors before executing an application, so Passenger will have to
|
|
550
588
|
communicate with the spawn server via a non-anonymous channel, such as a named
|
|
@@ -552,20 +590,20 @@ Unix socket. Because other processes can access this channel, it can introduce
|
|
|
552
590
|
potential security problems. Note that passing information via program arguments
|
|
553
591
|
is not secure: it is possible to view that information with tools like <em>ps</em>,
|
|
554
592
|
or (on Linux) by reading the file <tt>/proc/$PID/cmdline</tt>.</p></div>
|
|
555
|
-
<div class="
|
|
556
|
-
<h3 id="_common_security_issues">2.7. Common security issues</h3
|
|
557
|
-
<div class="
|
|
593
|
+
<div class="paragraph"><p>So it seems <em>sudo</em> is not a viable alternative.</p></div>
|
|
594
|
+
<h3 id="_common_security_issues">2.7. Common security issues</h3>
|
|
595
|
+
<div class="paragraph"><p>Whatever method Passenger will use, the following security principles must be
|
|
558
596
|
honored:</p></div>
|
|
559
|
-
<div class="
|
|
597
|
+
<div class="ulist"><ul>
|
|
560
598
|
<li>
|
|
561
599
|
<p>
|
|
562
600
|
Rails applications must never be run as root.
|
|
563
601
|
</p>
|
|
564
602
|
</li>
|
|
565
603
|
</ul></div>
|
|
566
|
-
<div class="
|
|
567
|
-
<div class="
|
|
568
|
-
<div class="
|
|
604
|
+
<div class="paragraph"><p>It might also be worthy to look into suEXEC’s security model for inspiration.</p></div>
|
|
605
|
+
<div class="paragraph"><p>Also, the following questions remain:</p></div>
|
|
606
|
+
<div class="ulist"><ul>
|
|
569
607
|
<li>
|
|
570
608
|
<p>
|
|
571
609
|
Is there a need for a user whitelist/blacklist? That is, is there a need for
|
|
@@ -576,29 +614,29 @@ Is there a need for a user whitelist/blacklist? That is, is there a need for
|
|
|
576
614
|
</div>
|
|
577
615
|
<h2 id="_chosen_solution">3. Chosen solution</h2>
|
|
578
616
|
<div class="sectionbody">
|
|
579
|
-
<div class="
|
|
580
|
-
contestants. The former is preferred, because it
|
|
581
|
-
<div class="
|
|
617
|
+
<div class="paragraph"><p>Running Apache as root and writing a setuid root wrapper are the main
|
|
618
|
+
contestants. The former is preferred, because it’s easier to implement.</p></div>
|
|
619
|
+
<div class="paragraph"><p>We have had some conversations with people on the IRC channel #rubyonrails.
|
|
582
620
|
Among those people, nobody has ever run Apache as non-root. Because of this
|
|
583
621
|
we have chosen to implement the <a href="#apache_root">Running Apache as root</a>
|
|
584
622
|
solution, until a significant number of users request us to implement the
|
|
585
623
|
<a href="#setuid_root">setuid root wrapper</a> solution.</p></div>
|
|
586
|
-
<div class="
|
|
587
|
-
that of the <em>ApplicationSpawner</em> class
|
|
624
|
+
<div class="paragraph"><p>Please read <a href="rdoc/index.html">the Ruby API documentation</a> — in particular
|
|
625
|
+
that of the <em>ApplicationSpawner</em> class — for implementation details. But to
|
|
588
626
|
make a long story short: it will switch to the owner of the file
|
|
589
627
|
<em>config/environment.rb</em>. User whitelisting/blacklisting is currently not
|
|
590
628
|
implemented. We rely on the system administrator to set the correct owner
|
|
591
629
|
on that file.</p></div>
|
|
592
|
-
<div class="
|
|
630
|
+
<div class="paragraph"><p>We have also not implemented suEXEC’s security model. suEXEC’s model is quite
|
|
593
631
|
paranoid, and although paranoia is good to a certain extend, it can be in the
|
|
594
632
|
way of usability while proving little extra security. We are not entirely
|
|
595
|
-
convinced that implementing suEXEC
|
|
633
|
+
convinced that implementing suEXEC’s full security model will provide
|
|
596
634
|
significant benefits, but if you have good reasons to think otherwise, please
|
|
597
635
|
feel free to discuss it with us.</p></div>
|
|
598
636
|
</div>
|
|
599
637
|
<div id="footer">
|
|
600
638
|
<div id="footer-text">
|
|
601
|
-
Last updated 2009-
|
|
639
|
+
Last updated 2009-11-24 04:33:45 PDT
|
|
602
640
|
</div>
|
|
603
641
|
</div>
|
|
604
642
|
</body>
|