passenger 3.0.21 → 3.9.1.beta

data/doc/DebuggingAndStressTesting.txt.md

@@ -0,0 +1,49 @@
+# Debugging and Stress Testing Phusion Passenger
+
+This guide tells you:
+
+ * How to debug Phusion Passenger in case of any serious problems, e.g. crashes and mysterious connection problems.
+ * How to stress test Phusion Passenger.
+
+## Process output
+
+All Phusion Passenger agent processes (PassengerWatchdog, PassengerHelperAgent, PassengerLoggingAgent) as well as all spawned application processes have their stdout and stderr redirected to the global web server error log. This is usually '/var/log/apache2/error.log' or '/var/log/nginx/error.log'.
+
+## Crash behavior
+
+Whenever a Phusion Passenger agent process crashes because of a signal (SIGABRT, SIGBUS, SIGSEGV and similar signals), its default behavior is to attempt to write a crash report to its stderr. This crash report contains:
+
+ * A simple libc-level backtrace of the current thread. This backtrace may or may not correspond to the thread that caused the crash.
+ * A detailed backtrace report, covering all threads. This report even contains the values of variables on the stack. The report is obtained through the [crash-watch](https://github.com/FooBarWidget/crash-watch) tool so you must have it installed. Crash-watch in turn requires gdb, which must also be installed.
+ * Agent-specific diagnostics information. For example the HelperAgent will report the status of its process pool and its connected clients.
+
+You can change the crash behavior with the following environment variables:
+
+ * `PASSENGER_ABORT_HANDLER` (default: true) - Whether agent processes should install their crash handlers. When disabled, crashes will be handled by the default signal handler, meaning that they will likely just crash without dumping any crash report.
+ * `PASSENGER_DUMP_WITH_CRASH_WATCH` (default: true) - Whether [crash-watch](https://github.com/FooBarWidget/crash-watch) should be used to obtain detailed backtraces.
+ * `PASSENGER_BEEP_ON_ABORT` (default: false) - Whether agent processes should beep when they crash. This is useful during development, e.g. when you're stress testing the system and want to be notified when a crash occurs. On OS X, it will execute `osascript -e "beep 2"` to trigger the beep. On Linux it will execute the `beep` command.
+ * `PASSENGER_STOP_ON_ABORT` (default: false) - When enabled, causes agent processes to stop themselves on crash, by raising SIGSTOP. This gives you the opportunity to attach gdb on them.
+
+## Behavior logging
+
+Increase PassengerLogLevel to print more debugging messages.
+
+## Debugging with AddressSanitizer
+
+[AddressSanitizer](http://code.google.com/p/address-sanitizer/) is an excellent tool created by Google to detect memory problems in C and C++ programs. It is for example used for detecting memory errors in Google Chrome. Unlike [Valgrind](http://www.valgrind.org/), which is an x86 emulator and makes everything 100 times slower, AddressSanitizer's performance penalty is only about 10%.
+
+Recompile Phusion Passenger with the environment variable `USE_ASAN=1` to enable support for AddressSanitizer.
+
+## Simulating system call failures
+
+Error conditions are sometimes hard to test. Things like network errors are usually hard to simulate using real equipment. In order to facilitate with error testing, we've developed a system call failure simulation framework, inspired by sqlite's failure test suite. You specify which system call errors should be simulated, and with what probability they should occur. By running normal tests multiple times you can see how Phusion Passenger behaves under these simulated error conditions.
+
+To enable, set the environment variable `PASSENGER_SIMULATE_SYSCALL_FAILURES`. The format is:
+
+    program_name1=error1:probability1,error2:probability2,...;program_name2=...
+
+`program_nameN` specifies the name of the Phusion Passenger process for which system call failure simulation should be enabled. This is followed by a list of system call `errno` names and the respective probabilities (between 0 and 1). For example:
+
+    export PASSENGER_SIMULATE_SYSCALL_FAILURES='PassengerWatchdog=ENOSPC:0.01;PassengerHelperAgent=EMFILE:0.001,ECONNREFUSED:0.02'
+
+This will enable system call failure simulation only for PassengerWatchdog and PassengerHelperAgent, but not for PassengerLoggingAgent. All system calls in PassengerWatchdog will have a 1% probability of throwing ENOSPC. All system calls in PassengerHelperAgent will have a 0.1% probability of throwing EMFILE, and a 2% probability of throwing ECONNREFUSED.

data/doc/Packaging.txt.md

@@ -0,0 +1,254 @@
+# Introduction
+
+Phusion Passenger can be configured in 2 ways, the "originally packaged"
+configuration and the "natively packaged" configuration. Depending on the
+configuration, Phusion Passenger locates its files (also called _assets_)
+in a different manner.
+
+## Originally packaged
+
+This is the configuration you get when you checkout Phusion Passenger from git,
+when you install Phusion Passenger from a gem or when you extract it from a tarball.
+All the original files are stored in a single directory tree, which we call the
+_source root_.
+
+This configuration does not come with any binaries; they have to be compiled by the
+user. Binaries may either be located in the source root, or located in a different
+location. The following rules apply when it comes to looking for binaries and
+determining where to store compiled binaries:
+
+ * It will normally look for binaries in a subdirectory under the source root, and
+   it will store compiled binaries in a subdirectory under the source root.
+ * Phusion Passenger Standalone does things a little differently. It looks for
+   its binaries in one of these places, whichever first exists:
+
+    - `~/.passenger/standalone/<VERSION>/<TYPE-AND-ARCH>` (a)
+    - `/var/lib/passenger-standalone/<VERSION-AND-ARCH>` (b)
+
+   If neither directories exist, then Passenger Standalone compiles the binaries and
+   stores them in (b) (when running as root) or in (a). It still looks for everything
+   else (like the .rb files) in the source root.
+
+## Natively packaged
+
+Phusion Passenger is packaged, usually (but not necessarily) through a DEB or RPM
+package. This configuration comes not only with all necessary binaries, but also
+with some (but not all) source files. This is because when you run Phusion Passenger
+with a different Ruby interpreter than the packager intended, Phusion Passenger
+must be able to compile a new Ruby extension for that Ruby interpreter. This
+configuration does not however allow compiling against a different Apache or Nginx
+version than the packager intended.
+
+In this configuration, files can be scattered anywhere throughout the filesystem. This
+way Phusion Passenger can be packaged in an FHS-compliant way. The exact locations
+of the different types of files can be specified through a
+_location configuration file_. The existance and usage of a location configuration
+file does not automatically imply that Phusion Passenger is natively packaged.
+
+This configuration also does not allow running Phusion Passenger Standalone against
+a different Nginx version than the packager intended, but does allow running
+against a different Ruby version. Passenger Standlone looks for its binaries
+in the location as specified by the location configuration file; it makes no
+attempt to compile anything, except of course for the Ruby extension.
+
+If either the non-Standalone or the Standalone Passenger needs to have a new Ruby
+extension compiled, then it will store that in `~/.passenger/native_support/<VERSION>/<ARCH>`.
+
+
+# The location configuration file
+
+The Phusion Passenger administration tools, such as `passenger-status`, look for a
+location configuration file in the following places, in the given order:
+
+ * The environment variable `$PASSENGER_LOCATION_CONFIGURATION_FILE`.
+ * `<RUBYLIBDIR>/phusion_passenger/locations.ini`, where <LIBDIR> is the Ruby library
+   directory that contains phusion_passenger.rb. For example,
+   `/usr/lib/ruby/1.9.0/phusion_passenger/locations.ini`.
+ * `~/.passenger/locations.ini`
+ * `/etc/phusion-passenger/locations.ini`
+
+If it cannot find a location configuration file, then it assumes that Phusion
+Passenger is originally packaged. If a location configuration file is found then
+the configuration is determined by the `natively_packaged` option in the
+location configuration file, which can be either "true" or "false".
+
+The Apache module and the Nginx module expect `PassengerRoot`/`passenger_root` to
+refer to either a directory or a file. If the value refers to a directory, then it
+assumes that Phusion Passenger is originally packaged, where the source root is the
+specified directory. If the value refers to a file, then it will use it as the
+location configuration file, and the configuration depends on the
+`natively_packaged` setting.
+
+The location configuration file is an ini file that looks as follows:
+
+    [locations]
+    natively_packaged=true
+    bin=/usr/bin
+    agents=/usr/lib/phusion-passenger
+    helper_scripts=/usr/share/phusion-passenger/helper-scripts
+    resources=/usr/share/phusion-passenger
+    doc=/usr/share/doc
+    rubylibdir=/usr/lib/ruby/1.9.0
+    apache2_module=/usr/lib/apache2/modules/mod_passenger.so
+    ruby_extension_source=/usr/share/phusion_passenger/ruby_native_support_source
+
+All keys except fo `natively_packaged` specify the locations of assets and asset
+directories. The "Asset types" section provides a description of all asset types.
+
+Thus, if you're packaging Phusion Passenger, then we recommend the following:
+
+ * Put a locations.ini file in `<RUBYLIBDIR>/phusion_passenger/locations.ini` and
+   set `PassengerRoot`/`passenger_root` to that filename. We don't recommend using
+   `~/.passenger` or `/etc/phusion-passenger` because if the user wants to install
+   a different Phusion Passenger version alongside the one that you've packaged,
+   then that other version will incorrectly locate your packaged files instead of
+   its own files.
+ * Always set `natively_packaged` to "true". The "false" value is used
+   internally for implementing Phusion Passenger Standalone and should never be
+   used by packagers.
+
+
+# The Phusion Passenger Ruby libraries
+
+## phusion_passenger.rb
+
+The Phusion Passenger administration tools are written in Ruby. So the first thing
+they do is trying to load `phusion_passenger.rb`, which is the source file
+responsible for figuring out where all the other Phusion Passenger files are. It
+tries to look for phusion_passenger.rb in `<OWN_DIRECTORY>/../lib` where
+`<OWN_DIRECTORY>` is the directory that the tool is located in. If
+phusion_passenger.rb is not there, then it tries to load it from the normal Ruby
+load path.
+
+## Ruby extension
+
+The Phusion Passenger loader scripts try to load the Phusion Passenger Ruby
+extension (`passenger_native_support.so`) from the following places, in the given order:
+
+ * If Phusion Passenger is originally packaged, it will look for the Ruby
+   extension in `<SOURCE_ROOT>/libout/ruby/<ARCH>`. Otherwise, this step is skipped.
+ * The Ruby library load path.
+ * `~/.passenger/native_support/<VERSION>/<ARCH>`
+
+If it cannot find the Ruby extension in any of the above places, then it will
+attempt to compile the Ruby extension and store it in
+`~/.passenger/native_support/<VERSION>/<ARCH>`.
+
+## Conclusion for packagers
+
+If you're packaging Phusion Passenger then you should put both phusion_passenger.rb
+and `passenger_native_support.so` somewhere in the Ruby load path, or make sure that
+that directory is included in the `$RUBYLIB` environment variable. You cannot specify
+a custom directory though the location configuration file.
+
+
+# Asset types
+
+Throughout the Phusion Passenger codebase, we refer to all kinds of assets. Here's
+a list of all possible assets and asset directories.
+
+ * `source_root`
+
+   When Phusion Passenger is originally packaged, this refers to the directory
+   that contains the entire Phusion passenger source tree. Not available when
+   natively packaged.
+
+ * `bin`
+
+   A directory containing administration binaries and scripts and like
+   `passenger-status`; tools that the user may directly invoke on the command line.
+
+   Value when originally packaged: `<SOURCE_ROOT>/bin`
+
+ * `agents`
+
+   A directory that contains (platform-dependent) binaries that Phusion Passenger
+   uses, but that should not be directly invoked from the command line. Things like
+   PassengerHelperAgent are located here.
+
+   Value when originally packaged:
+   - Normally: `<SOURCE_ROOT>/agents`
+   - Passenger Standalone: `~/.passenger/standalone/<VERSION>/support-<ARCH>`
+
+ * `helper_scripts`
+
+   A directory that contains non-binary scripts that Phusion Passenger uses, but
+   that should not be directly invoked from the command line. Things like
+   rack-loader.rb are located here.
+
+   Value when originally packaged: `<SOURCE_ROOT>/helper-scripts`
+
+ * `resources`
+
+   A directory that contains non-executable, platform-independent resource files
+   that the user should not directly access, like error page templates and
+   configuration file templates.
+
+   Value when originally packaged: `<SOURCE_ROOT>/resources`.
+
+ * `doc`
+
+   A directory that contains documentation.
+
+   Value when originally packaged: `<SOURCE_ROOT>/doc`.
+
+ * `rubylibdir`
+
+   A directory that contains the Phusion Passenger Ruby library files. Note that
+   the Phusion Passenger administration tools still locate phusion_passenger.rb
+   as described in the section "The Phusion Passenger Ruby libraries",
+   irregardless of the value of this key in the location configuration file.
+   The value is only useful to non-Ruby Phusion Passenger code.
+
+   Value when originally packaged: `<SOURCE_ROOT>/lib`.
+
+ * `apache2_module`
+
+   The filename of the Apache 2 module, or the filename that the Apache 2 module
+   will be stored after it's compiled. Used by `passenger-install-module` to
+   print an example configuration snippet.
+
+   Value when originally packaged: `<SOURCE_ROOT>/ext/apache2/mod_passenger.so`.
+
+ * `ruby_extension_source`
+
+   The directory that contains the source code for the Phusion Passenger Ruby
+   extension.
+
+   Value when originally packaged: `<SOURCE_ROOT>/ext/ruby`.
+
+
+# Vendoring of libraries
+
+Phusion Passenger vendors libev and libeio in order to make installation easier
+for users on operating systems without proper package management, like OS X.
+If you want Phusion Passenger to compile against the system-provided
+libev and/or libeio instead, then set the following environment variables
+before compiling:
+
+ * `export USE_VENDORED_LIBEV=no`
+ * `export USE_VENDORED_LIBEIO=no`
+
+Note that we require at least libev 4.11 and libeio 1.0.
+
+
+# Misc notes
+
+## Generating gem and tarball
+
+Use the following command to generate a gem and tarball, in which Phusion
+Passenger is originally packaged and without any binaries:
+
+    rake package
+
+The files will be stored in `pkg/`.
+
+## Fakeroot
+
+You can generate a fakeroot with the command `rake fakeroot`. This will
+generate an FHS-compliant directory tree in `pkg/fakeroot`, which you can
+directly package or with minor modifications. The fakeroot even contains
+a location configuration file.
+
+If the default fakeroot structure is not sufficient, please consider
+sending a patch.

data/doc/Security of user switching support.html

@@ -1,9 +1,9 @@
 <!DOCTYPE html>
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<meta name="generator" content="AsciiDoc 8.6.7">
-<title>Security of user switching support in Passenger</title>
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<meta name="generator" content="AsciiDoc 8.6.7">
+<title>Security of user switching support in Passenger</title>
 <style type="text/css">
 /* Shared CSS for AsciiDoc xhtml11 and html5 backends */
 
@@ -603,7 +603,7 @@ div.exampleblock > div.content, div.sidebarblock > div.content, div.listingblock
 div.verseblock { border-left-width: 0; margin-left: 3em; }
 div.quoteblock { border-left-width: 3px; margin-left: 0; margin-right: 0;}
 div.admonitionblock td.content { border-left: 3px solid #E8E8E8; }
-</style>
+</style>
 <script type="text/javascript">
 /*<![CDATA[*/
 var asciidoc = {  // Namespace.
@@ -795,14 +795,11 @@ install: function(toclevels) {
 }
 
 }
-asciidoc.install();
+asciidoc.install(3);
 /*]]>*/
-</script>
-<style type="text/css">
+</script><style type="text/css">
 body {
-	margin: 1em auto 1em auto;
-	padding: 0 1em 0 1em;
-	max-width: 800px;
+	margin: 1em 10% 1em 10%;
 }
 
 a.image {
@@ -881,10 +878,6 @@ a.image {
 	margin: 2em;
 }
 
-pre {
-	overflow: auto;
-}
-
 @media print {
 	body {
 		font-size: 18pt;
@@ -1045,53 +1038,34 @@ pre {
 	border-bottom-right-radius: 0;
 }
 
-/* http://nicolasgallagher.com/jump-links-and-viewport-positioning/ */
-.anchor_helper {
-	position: relative;
-	display: block;
-	top: -50px;
-	width: 1px;
-	height: 1px;
-}
-
 </style>
-</head>
+</head>
 <body class="article">
 <div id="topbar" style="display: none">
 	<div class="title">
-		<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAsAAAAKCAYAAAEV95QVAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9sGCRMSACDxkZwAAAAidEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVAgb24gYSBNYWOHqHdDAAAAZUlEQVQY032PSxbAIAjEIlfygL6ePF3UUvpzNjgSYWwqAMEhUQnANnsC7TQPeJpsVWzMuh2sog4vDTUbqP081zECrW4dtdaQGSIKlWluPyjK+VXxAz5XfcKufCzA130AfQHWB30HZxlPaP080xsAAAAASUVORK5CYII=" width="11" height="10" alt="">
-		<a href="javascript:void(Mizuho.smoothlyScrollToToc())">Security of user switching support in Passenger</a>
+		<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAsAAAAKCAYAAAEV95QVAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9sGCRMSACDxkZwAAAAidEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVAgb24gYSBNYWOHqHdDAAAAZUlEQVQY032PSxbAIAjEIlfygL6ePF3UUvpzNjgSYWwqAMEhUQnANnsC7TQPeJpsVWzMuh2sog4vDTUbqP081zECrW4dtdaQGSIKlWluPyjK+VXxAz5XfcKufCzA130AfQHWB30HZxlPaP080xsAAAAASUVORK5CYII=" width="11" height="10" alt=""><a href="javascript:void(Mizuho.smoothlyScrollToToc())">Security of user switching support in Passenger</a>
 	</div>
 	<a href="javascript:void(0)" id="current_section"></a>
 </div>
 <div id="header">
 <h1>Security of user switching support in Passenger</h1>
 <div id="toc">
-<div id="toctitle">Table of Contents</div>
-<div class="foo toclevel2"><a href="#_problem_description">1. Problem description</a></div>
-<div class="foo toclevel2"><a href="#_analysis_of_possible_solutions">2. Analysis of possible solutions</a></div>
-<div class="foo toclevel3"><a href="#apache_root">2.1. Apache must already be running as root</a></div>
-<div class="foo toclevel3"><a href="#_using_apache_8217_s_suexec">2.2. Using Apache’s suEXEC</a></div>
-<div class="foo toclevel3"><a href="#_using_a_setuid_root_wrapper_application">2.3. Using a setuid root wrapper application</a></div>
-<div class="foo toclevel3"><a href="#setuid_root">2.4. Using a setuid $X wrapper application</a></div>
-<div class="foo toclevel3"><a href="#_using_em_su_em">2.5. Using su</a></div>
-<div class="foo toclevel3"><a href="#_using_em_sudo_em">2.6. Using sudo</a></div>
-<div class="foo toclevel3"><a href="#_common_security_issues">2.7. Common security issues</a></div>
-<div class="foo toclevel2"><a href="#_chosen_solution">3. Chosen solution</a></div>
-</div>
+  <div id="toctitle">Table of Contents</div>
+  <noscript><p><b>JavaScript must be enabled in your browser to display the table of contents.</b></p></noscript>
+</div>
 </div>
 <div id="content">
 <div class="sect1">
-<span class="anchor_helper" id="_problem_description"></span><h2 data-anchor="_problem_description">1. Problem description</h2>
+<h2 id="_problem_description">1. Problem description</h2>
 <div class="sectionbody">
 <div class="admonitionblock">
-<table><tr>
+<table><tr>
 <td class="icon">
-<img src="./images/icons/tip.png" alt="Tip">
+<img src="./images/icons/tip.png" alt="Tip">
 </td>
 <td class="content">It is strongly recommended that you first read our
 <a href="Architectural%20overview.html">Architectural Overview</a>.</td>
-</tr></table>
+</tr></table>
 </div>
 <div class="paragraph"><p>A straightforward implementation of Passenger will spawn Rails applications in
 the same user context as Apache itself. On server machines which host multiple
@@ -1106,12 +1080,12 @@ Passenger’s security may be peer reviewed.</p></div>
 </div>
 </div>
 <div class="sect1">
-<span class="anchor_helper" id="_analysis_of_possible_solutions"></span><h2 data-anchor="_analysis_of_possible_solutions">2. Analysis of possible solutions</h2>
+<h2 id="_analysis_of_possible_solutions">2. Analysis of possible solutions</h2>
 <div class="sectionbody">
 <div class="paragraph"><p>It seems that the only way to solve this problem on Unix, is to run each Rails
 application server as its owner’s user and group. Passenger can make use of
 one of the following methods to implement this:</p></div>
-<div class="olist arabic"><ol class="arabic">
+<div class="olist arabic"><ol class="arabic">
 <li>
 <p>
 Apache (and thus Passenger) must already be running as root.
@@ -1147,7 +1121,7 @@ Using <em>sudo</em>.
 </ol></div>
 <div class="paragraph"><p>Let us take a look at each method in detail.</p></div>
 <div class="sect2">
-<span class="anchor_helper" id="apache_root"></span><h3 data-anchor="apache_root">2.1. Apache must already be running as root</h3>
+<h3 id="apache_root">2.1. Apache must already be running as root</h3>
 <div class="paragraph"><p>First, let us take a look at the typical Apache setup, in which Apache is bound
 to port 80, and uses the prefork MPM. Binding to any port lower than 1024
 requires root privileges, so Apache is typically run as root. This poses an
@@ -1175,7 +1149,7 @@ this method in automated unit tests will require running the unit test suit as
 root.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="_using_apache_8217_s_suexec"></span><h3 data-anchor="_using_apache_8217_s_suexec">2.2. Using Apache’s suEXEC</h3>
+<h3 id="_using_apache_8217_s_suexec">2.2. Using Apache’s suEXEC</h3>
 <div class="paragraph"><p>Apache’s <a href="http://httpd.apache.org/docs/2.0/suexec.html">suEXEC</a> allows one to
 run CGI processes as different users. But it seems that suEXEC can only be
 used for CGI, and is not a general-purpose mechanism. The
@@ -1185,7 +1159,7 @@ to use suEXEC, then it is likely that we’ll have to patch suEXEC. The suEXEC
 website strongly discourages patching.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="_using_a_setuid_root_wrapper_application"></span><h3 data-anchor="_using_a_setuid_root_wrapper_application">2.3. Using a setuid root wrapper application</h3>
+<h3 id="_using_a_setuid_root_wrapper_application">2.3. Using a setuid root wrapper application</h3>
 <div class="paragraph"><p>If we use this method, we must be extremely careful. It must not be possible
 for arbitrary processes to gain root privileges. We want Passenger, and only
 Passenger, to be able to gain root privileges.</p></div>
@@ -1194,7 +1168,7 @@ a password file, which only Apache and the wrapper can read, through
 the use of proper file permissions. The password file must never be world
 readable or writable.</p></div>
 <div class="paragraph"><p>It works as follows:</p></div>
-<div class="olist arabic"><ol class="arabic">
+<div class="olist arabic"><ol class="arabic">
 <li>
 <p>
 Passenger runs the wrapper.
@@ -1228,7 +1202,7 @@ process’s user is in the whitelist.</p></div>
 run as root, in contrast to the run-Apache-as-root method.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="setuid_root"></span><h3 data-anchor="setuid_root">2.4. Using a setuid $X wrapper application</h3>
+<h3 id="setuid_root">2.4. Using a setuid $X wrapper application</h3>
 <div class="paragraph"><p>A setuid $X wrapper will work in a fashion similar to the setuid root wrapper,
 i.e. it will use a password file for authorization.</p></div>
 <div class="paragraph"><p>Passenger does not spawn Rails applications itself, but does so via the spawn
@@ -1246,13 +1220,13 @@ methods.</p></div>
 wrapper for each user, and to install it.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="_using_em_su_em"></span><h3 data-anchor="_using_em_su_em">2.5. Using <em>su</em>
+<h3 id="_using_em_su_em">2.5. Using <em>su</em>
 </h3>
 <div class="paragraph"><p>The standard Unix <em>su</em> tool asks for the root password. It’s a bad idea for
 Apache to know the root password, so using <em>su</em> is not a viable alternative.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="_using_em_sudo_em"></span><h3 data-anchor="_using_em_sudo_em">2.6. Using <em>sudo</em>
+<h3 id="_using_em_sudo_em">2.6. Using <em>sudo</em>
 </h3>
 <div class="paragraph"><p>It might be possible to use the <em>sudo</em> utility. sudo can be configured in
 such a way that the user Apache runs as can use sudo without having to enter a
@@ -1268,10 +1242,10 @@ or (on Linux) by reading the file <span class="monospaced">/proc/$PID/cmdline</s
 <div class="paragraph"><p>So it seems <em>sudo</em> is not a viable alternative.</p></div>
 </div>
 <div class="sect2">
-<span class="anchor_helper" id="_common_security_issues"></span><h3 data-anchor="_common_security_issues">2.7. Common security issues</h3>
+<h3 id="_common_security_issues">2.7. Common security issues</h3>
 <div class="paragraph"><p>Whatever method Passenger will use, the following security principles must be
 honored:</p></div>
-<div class="ulist"><ul>
+<div class="ulist"><ul>
 <li>
 <p>
 Rails applications must never be run as root.
@@ -1280,7 +1254,7 @@ Rails applications must never be run as root.
 </ul></div>
 <div class="paragraph"><p>It might also be worthy to look into suEXEC’s security model for inspiration.</p></div>
 <div class="paragraph"><p>Also, the following questions remain:</p></div>
-<div class="ulist"><ul>
+<div class="ulist"><ul>
 <li>
 <p>
 Is there a need for a user whitelist/blacklist? That is, is there a need for
@@ -1292,7 +1266,7 @@ Is there a need for a user whitelist/blacklist? That is, is there a need for
 </div>
 </div>
 <div class="sect1">
-<span class="anchor_helper" id="_chosen_solution"></span><h2 data-anchor="_chosen_solution">3. Chosen solution</h2>
+<h2 id="_chosen_solution">3. Chosen solution</h2>
 <div class="sectionbody">
 <div class="paragraph"><p>Running Apache as root and writing a setuid root wrapper are the main
 contestants. The former is preferred, because it’s easier to implement.</p></div>
@@ -1318,7 +1292,9 @@ feel free to discuss it with us.</p></div>
 </div>
 <div id="footnotes"><hr></div>
 <div id="footer">
-
+<div id="footer-text">
+Last updated 2010-09-25 20:09:08 CEST
+</div>
 </div>
 <script>/*! jQuery v1.7.1 jquery.com | jquery.org/license */
 (function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){cl||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"")+"<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g++){if(g===1)for(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l+" "+k,n=e[m]||e["* "+k];if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1]+" "+k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No conversion from "+m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(c)))}}return c}function cb(a,c,d){var e=a.contents,f=a.dataTypes,g=a.responseFields,h,i,j,k;for(i in g)i in d&&(c[g[i]]=d[i]);while(f[0]==="*")f.shift(),h===b&&(h=a.mimeType||c.getResponseHeader("content-type"));if(h)for(i in e)if(e[i]&&e[i].test(h)){f.unshift(i);break}if(f[0]in d)j=f[0];else{for(i in d){if(!f[0]||a.converters[i+" "+f[0]]){j=i;break}k||(k=i)}j=j||k}if(j){j!==f[0]&&f.unshift(j);return d[j]}}function ca(a,b,c,d){if(f.isArray(b))f.each(b,function(b,e){c||bE.test(a)?d(a,e):ca(a+"["+(typeof e=="object"||f.isArray(e)?b:"")+"]",e,c,d)});else if(!c&&b!=null&&typeof b=="object")for(var e in b)ca(a+"["+e+"]",b[e],c,d);else d(a,b)}function b_(a,c){var d,e,g=f.ajaxSettings.flatOptions||{};for(d in c)c[d]!==b&&((g[d]?a:e||(e={}))[d]=c[d]);e&&f.extend(!0,a,e)}function b$(a,c,d,e,f,g){f=f||c.dataTypes[0],g=g||{},g[f]=!0;var h=a[f],i=0,j=h?h.length:0,k=a===bT,l;for(;i<j&&(k||!l);i++)l=h[i](c,d,e),typeof l=="string"&&(!k||g[l]?l=b:(c.dataTypes.unshift(l),l=b$(a,c,d,e,l,g)));(k||!l)&&!g["*"]&&(l=b$(a,c,d,e,"*",g));return l}function bZ(a){return function(b,c){typeof b!="string"&&(c=b,b="*");if(f.isFunction(c)){var d=b.toLowerCase().split(bP),e=0,g=d.length,h,i,j;for(;e<g;e++)h=d[e],j=/^\+/.test(h),j&&(h=h.substr(1)||"*"),i=a[h]=a[h]||[],i[j?"unshift":"push"](c)}}}function bC(a,b,c){var d=b==="width"?a.offsetWidth:a.offsetHeight,e=b==="width"?bx:by,g=0,h=e.length;if(d>0){if(c!=="border")for(;g<h;g++)c||(d-=parseFloat(f.css(a,"padding"+e[g]))||0),c==="margin"?d+=parseFloat(f.css(a,c+e[g]))||0:d-=parseFloat(f.css(a,"border"+e[g]+"Width"))||0;return d+"px"}d=bz(a,b,b);if(d<0||d==null)d=a.style[b]||0;d=parseFloat(d)||0;if(c)for(;g<h;g++)d+=parseFloat(f.css(a,"padding"+e[g]))||0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+e[g]+"Width"))||0),c==="margin"&&(d+=parseFloat(f.css(a,c+e[g]))||0);return d+"px"}function bp(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text||b.textContent||b.innerHTML||"").replace(bf,"/*$0*/")),b.parentNode&&b.parentNode.removeChild(b)}function bo(a){var b=c.createElement("div");bh.appendChild(b),b.innerHTML=a.outerHTML;return b.firstChild}function bn(a){var b=(a.nodeName||"").toLowerCase();b==="input"?bm(a):b!=="script"&&typeof a.getElementsByTagName!="undefined"&&f.grep(a.getElementsByTagName("input"),bm)}function bm(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bl(a){return typeof a.getElementsByTagName!="undefined"?a.getElementsByTagName("*"):typeof a.querySelectorAll!="undefined"?a.querySelectorAll("*"):[]}function bk(a,b){var c;if(b.nodeType===1){b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase();if(c==="object")b.outerHTML=a.outerHTML;else if(c!=="input"||a.type!=="checkbox"&&a.type!=="radio"){if(c==="option")b.selected=a.defaultSelected;else if(c==="input"||c==="textarea")b.defaultValue=a.defaultValue}else a.checked&&(b.defaultChecked=b.checked=a.checked),b.value!==a.value&&(b.value=a.value);b.removeAttribute(f.expando)}}function bj(a,b){if(b.nodeType===1&&!!f.hasData(a)){var c,d,e,g=f._data(a),h=f._data(b,g),i=g.events;if(i){delete h.handle,h.events={};for(c in i)for(d=0,e=i[c].length;d<e;d++)f.event.add(b,c+(i[c][d].namespace?".":"")+i[c][d].namespace,i[c][d],i[c][d].data)}h.data&&(h.data=f.extend({},h.data))}}function bi(a,b){return f.nodeName(a,"table")?a.getElementsByTagName("tbody")[0]||a.appendChild(a.ownerDocument.createElement("tbody")):a}function U(a){var b=V.split("|"),c=a.createDocumentFragment();if(c.createElement)while(b.length)c.createElement(b.pop());return c}function T(a,b,c){b=b||0;if(f.isFunction(b))return f.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return f.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=f.grep(a,function(a){return a.nodeType===1});if(O.test(b))return f.filter(b,d,!c);b=f.filter(b,d)}return f.grep(a,function(a,d){return f.inArray(a,b)>=0===c})}function S(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function K(){return!0}function J(){return!1}function n(a,b,c){var d=b+"defer",e=b+"queue",g=b+"mark",h=f._data(a,d);h&&(c==="queue"||!f._data(a,e))&&(c==="mark"||!f._data(a,g))&&setTimeout(function(){!f._data(a,e)&&!f._data(a,g)&&(f.removeData(a,d,!0),h.fire())},0)}function m(a){for(var b in a){if(b==="data"&&f.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function l(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(k,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNumeric(d)?parseFloat(d):j.test(d)?f.parseJSON(d):d}catch(g){}f.data(a,c,d)}else d=b}return d}function h(a){var b=g[a]={},c,d;a=a.split(/\s+/);for(c=0,d=a.length;c<d;c++)b[a[c]]=!0;return b}var c=a.document,d=a.navigator,e=a.location,f=function(){function J(){if(!e.isReady){try{c.documentElement.doScroll("left")}catch(a){setTimeout(J,1);return}e.ready()}}var e=function(a,b){return new e.fn.init(a,b,h)},f=a.jQuery,g=a.$,h,i=/^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,n=/^[\],:{}\s]*$/,o=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,p=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,q=/(?:^|:|,)(?:\s*\[)+/g,r=/(webkit)[ \/]([\w.]+)/,s=/(opera)(?:.*version)?[ \/]([\w.]+)/,t=/(msie) ([\w.]+)/,u=/(mozilla)(?:.*? rv:([\w.]+))?/,v=/-([a-z]|[0-9])/ig,w=/^-ms-/,x=function(a,b){return(b+"").toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeType){this.context=this[0]=a,this.length=1;return this}if(a==="body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"||a.charAt(a.length-1)!==">"||a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]||!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d?d.ownerDocument||d:c,j=m.exec(a),j?e.isPlainObject(d)?(a=[c.createElement(j[1])],e.fn.attr.call(a,d,!0)):a=[k.createElement(j[1])]:(j=e.buildFragment([g[1]],[k]),a=(j.cacheable?e.clone(j.fragment):j.fragment).childNodes);return e.merge(this,a)}h=c.getElementById(g[2]);if(h&&h.parentNode){if(h.id!==g[2])return f.find(a);this.length=1,this[0]=h}this.context=c,this.selector=a;return this}return!d||d.jquery?(d||f).find(a):this.constructor(d).find(a)}if(e.isFunction(a))return f.ready(a);a.selector!==b&&(this.selector=a.selector,this.context=a.context);return e.makeArray(a,this)},selector:"",jquery:"1.7.1",length:0,size:function(){return this.length},toArray:function(){return F.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this[this.length+a]:this[a]},pushStack:function(a,b,c){var d=this.constructor();e.isArray(a)?E.apply(d,a):e.merge(d,a),d.prevObject=this,d.context=this.context,b==="find"?d.selector=this.selector+(this.selector?" ":"")+c:b&&(d.selector=this.selector+"."+b+"("+c+")");return d},each:function(a,b){return e.each(this,a,b)},ready:function(a){e.bindReady(),A.add(a);return this},eq:function(a){a=+a;return a===-1?this.slice(a):this.slice(a,a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:function(a){return this.pushStack(e.map(this,function(b,c){return a.call(b,c,b)}))},end:function(){return this.prevObject||this.constructor(null)},push:E,sort:[].sort,splice:[].splice},e.fn.init.prototype=e.fn,e.extend=e.fn.extend=function(){var a,c,d,f,g,h,i=arguments[0]||{},j=1,k=arguments.length,l=!1;typeof i=="boolean"&&(l=i,i=arguments[1]||{},j=2),typeof i!="object"&&!e.isFunction(i)&&(i={}),k===j&&(i=this,--j);for(;j<k;j++)if((a=arguments[j])!=null)for(c in a){d=i[c],f=a[c];if(i===f)continue;l&&f&&(e.isPlainObject(f)||(g=e.isArray(f)))?(g?(g=!1,h=d&&e.isArray(d)?d:[]):h=d&&e.isPlainObject(d)?d:{},i[c]=e.extend(l,h,f)):f!==b&&(i[c]=f)}return i},e.extend({noConflict:function(b){a.$===e&&(a.$=g),b&&a.jQuery===e&&(a.jQuery=f);return e},isReady:!1,readyWait:1,holdReady:function(a){a?e.readyWait++:e.ready(!0)},ready:function(a){if(a===!0&&!--e.readyWait||a!==!0&&!e.isReady){if(!c.body)return setTimeout(e.ready,1);e.isReady=!0;if(a!==!0&&--e.readyWait>0)return;A.fireWith(c,[e]),e.fn.trigger&&e(c).trigger("ready").off("ready")}},bindReady:function(){if(!A){A=e.Callbacks("once memory");if(c.readyState==="complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.frameElement==null}catch(d){}c.documentElement.doScroll&&b&&J()}}},isFunction:function(a){return e.type(a)==="function"},isArray:Array.isArray||function(a){return e.type(a)==="array"},isWindow:function(a){return a&&typeof a=="object"&&"setInterval"in a},isNumeric:function(a){return!isNaN(parseFloat(a))&&isFinite(a)},type:function(a){return a==null?String(a):I[C.call(a)]||"object"},isPlainObject:function(a){if(!a||e.type(a)!=="object"||a.nodeType||e.isWindow(a))return!1;try{if(a.constructor&&!D.call(a,"constructor")&&!D.call(a.constructor.prototype,"isPrototypeOf"))return!1}catch(c){return!1}var d;for(d in a);return d===b||D.call(a,d)},isEmptyObject:function(a){for(var b in a)return!1;return!0},error:function(a){throw new Error(a)},parseJSON:function(b){if(typeof b!="string"||!b)return null;b=e.trim(b);if(a.JSON&&a.JSON.parse)return a.JSON.parse(b);if(n.test(b.replace(o,"@").replace(p,"]").replace(q,"")))return(new Function("return "+b))();e.error("Invalid JSON: "+b)},parseXML:function(c){var d,f;try{a.DOMParser?(f=new DOMParser,d=f.parseFromString(c,"text/xml")):(d=new ActiveXObject("Microsoft.XMLDOM"),d.async="false",d.loadXML(c))}catch(g){d=b}(!d||!d.documentElement||d.getElementsByTagName("parsererror").length)&&e.error("Invalid XML: "+c);return d},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(w,"ms-").replace(v,x)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,c,d){var f,g=0,h=a.length,i=h===b||e.isFunction(a);if(d){if(i){for(f in a)if(c.apply(a[f],d)===!1)break}else for(;g<h;)if(c.apply(a[g++],d)===!1)break}else if(i){for(f in a)if(c.call(a[f],f,a[f])===!1)break}else for(;g<h;)if(c.call(a[g],g,a[g++])===!1)break;return a},trim:G?function(a){return a==null?"":G.call(a)}:function(a){return a==null?"":(a+"").replace(k,"").replace(l,"")},makeArray:function(a,b){var c=b||[];if(a!=null){var d=e.type(a);a.length==null||d==="string"||d==="function"||d==="regexp"||e.isWindow(a)?E.call(c,a):e.merge(c,a)}return c},inArray:function(a,b,c){var d;if(b){if(H)return H.call(b,a,c);d=b.length,c=c?c<0?Math.max(0,d+c):c:0;for(;c<d;c++)if(c in b&&b[c]===a)return c}return-1},merge:function(a,c){var d=a.length,e=0;if(typeof c.length=="number")for(var f=c.length;e<f;e++)a[d++]=c[e];else while(c[e]!==b)a[d++]=c[e++];a.length=d;return a},grep:function(a,b,c){var d=[],e;c=!!c;for(var f=0,g=a.length;f<g;f++)e=!!b(a[f],f),c!==e&&d.push(a[f]);return d},map:function(a,c,d){var f,g,h=[],i=0,j=a.length,k=a instanceof e||j!==b&&typeof j=="number"&&(j>0&&a[0]&&a[j-1]||j===0||e.isArray(a));if(k)for(;i<j;i++)f=c(a[i],i,d),f!=null&&(h[h.length]=f);else for(g in a)f=c(a[g],g,d),f!=null&&(h[h.length]=f);return h.concat.apply([],h)},guid:1,proxy:function(a,c){if(typeof c=="string"){var d=a[c];c=a,a=d}if(!e.isFunction(a))return b;var f=F.call(arguments,2),g=function(){return a.apply(c,f.concat(F.call(arguments)))};g.guid=a.guid=a.guid||g.guid||e.guid++;return g},access:function(a,c,d,f,g,h){var i=a.length;if(typeof c=="object"){for(var j in c)e.access(a,j,c[j],f,g,d);return a}if(d!==b){f=!h&&f&&e.isFunction(d);for(var k=0;k<i;k++)g(a[k],c,f?d.call(a[k],k,g(a[k],c)):d,h);return a}return i?g(a[0],c):b},now:function(){return(new Date).getTime()},uaMatch:function(a){a=a.toLowerCase();var b=r.exec(a)||s.exec(a)||t.exec(a)||a.indexOf("compatible")<0&&u.exec(a)||[];return{browser:b[1]||"",version:b[2]||"0"}},sub:function(){function a(b,c){return new a.fn.init(b,c)}e.extend(!0,a,this),a.superclass=this,a.fn=a.prototype=this(),a.fn.constructor=a,a.sub=this.sub,a.fn.init=function(d,f){f&&f instanceof e&&!(f instanceof a)&&(f=a(f));return e.fn.init.call(this,d,f,b)},a.fn.init.prototype=a.fn;var b=a(c);return a},browser:{}}),e.each("Boolean Number String Function Array Date RegExp Object".split(" "),function(a,b){I["[object "+b+"]"]=b.toLowerCase()}),z=e.uaMatch(y),z.browser&&(e.browser[z.browser]=!0,e.browser.version=z.version),e.browser.webkit&&(e.browser.safari=!0),j.test(" ")&&(k=/^[\s\xA0]+/,l=/[\s\xA0]+$/),h=e(c),c.addEventListener?B=function(){c.removeEventListener("DOMContentLoaded",B,!1),e.ready()}:c.attachEvent&&(B=function(){c.readyState==="complete"&&(c.detachEvent("onreadystatechange",B),e.ready())});return e}(),g={};f.Callbacks=function(a){a=a?g[a]||h(a):{};var c=[],d=[],e,i,j,k,l,m=function(b){var d,e,g,h,i;for(d=0,e=b.length;d<e;d++)g=b[d],h=f.type(g),h==="array"?m(g):h==="function"&&(!a.unique||!o.has(g))&&c.push(g)},n=function(b,f){f=f||[],e=!a.memory||[b,f],i=!0,l=j||0,j=0,k=c.length;for(;c&&l<k;l++)if(c[l].apply(b,f)===!1&&a.stopOnFalse){e=!0;break}i=!1,c&&(a.once?e===!0?o.disable():c=[]:d&&d.length&&(e=d.shift(),o.fireWith(e[0],e[1])))},o={add:function(){if(c){var a=c.length;m(arguments),i?k=c.length:e&&e!==!0&&(j=a,n(e[0],e[1]))}return this},remove:function(){if(c){var b=arguments,d=0,e=b.length;for(;d<e;d++)for(var f=0;f<c.length;f++)if(b[d]===c[f]){i&&f<=k&&(k--,f<=l&&l--),c.splice(f--,1);if(a.unique)break}}return this},has:function(a){if(c){var b=0,d=c.length;for(;b<d;b++)if(a===c[b])return!0}return!1},empty:function(){c=[];return this},disable:function(){c=d=e=b;return this},disabled:function(){return!c},lock:function(){d=b,(!e||e===!0)&&o.disable();return this},locked:function(){return!d},fireWith:function(b,c){d&&(i?a.once||d.push([b,c]):(!a.once||!e)&&n(b,c));return this},fire:function(){o.fireWith(this,arguments);return this},fired:function(){return!!e}};return o};var i=[].slice;f.extend({Deferred:function(a){var b=f.Callbacks("once memory"),c=f.Callbacks("once memory"),d=f.Callbacks("memory"),e="pending",g={resolve:b,reject:c,notify:d},h={done:b.add,fail:c.add,progress:d.add,state:function(){return e},isResolved:b.fired,isRejected:c.fired,then:function(a,b,c){i.done(a).fail(b).progress(c);return this},always:function(){i.done.apply(i,arguments).fail.apply(i,arguments);return this},pipe:function(a,b,c){return f.Deferred(function(d){f.each({done:[a,"resolve"],fail:[b,"reject"],progress:[c,"notify"]},function(a,b){var c=b[0],e=b[1],g;f.isFunction(c)?i[a](function(){g=c.apply(this,arguments),g&&f.isFunction(g.promise)?g.promise().then(d.resolve,d.reject,d.notify):d[e+"With"](this===i?d:this,[g])}):i[a](d[e])})}).promise()},promise:function(a){if(a==null)a=h;else for(var b in h)a[b]=h[b];return a}},i=h.promise({}),j;for(j in g)i[j]=g[j].fire,i[j+"With"]=g[j].fireWith;i.done(function(){e="resolved"},c.disable,d.lock).fail(function(){e="rejected"},b.disable,d.lock),a&&a.call(i,i);return i},when:function(a){function m(a){return function(b){e[a]=arguments.length>1?i.call(arguments,0):b,j.notifyWith(k,e)}}function l(a){return function(c){b[a]=arguments.length>1?i.call(arguments,0):c,--g||j.resolveWith(j,b)}}var b=i.call(arguments,0),c=0,d=b.length,e=Array(d),g=d,h=d,j=d<=1&&a&&f.isFunction(a.promise)?a:f.Deferred(),k=j.promise();if(d>1){for(;c<d;c++)b[c]&&b[c].promise&&f.isFunction(b[c].promise)?b[c].promise().then(l(c),j.reject,m(c)):--g;g||j.resolveWith(j,b)}else j!==a&&j.resolveWith(j,d?[a]:[]);return k}}),f.support=function(){var b,d,e,g,h,i,j,k,l,m,n,o,p,q=c.createElement("div"),r=c.documentElement;q.setAttribute("className","t"),q.innerHTML="   <link/><table></table><a href='/a' style='top:1px;float:left;opacity:.55;'>a</a><input type='checkbox'/>",d=q.getElementsByTagName("*"),e=q.getElementsByTagName("a")[0];if(!d||!d.length||!e)return{};g=c.createElement("select"),h=g.appendChild(c.createElement("option")),i=q.getElementsByTagName("input")[0],b={leadingWhitespace:q.firstChild.nodeType===3,tbody:!q.getElementsByTagName("tbody").length,htmlSerialize:!!q.getElementsByTagName("link").length,style:/top/.test(e.getAttribute("style")),hrefNormalized:e.getAttribute("href")==="/a",opacity:/^0.55/.test(e.style.opacity),cssFloat:!!e.style.cssFloat,checkOn:i.value==="on",optSelected:h.selected,getSetAttribute:q.className!=="t",enctype:!!c.createElement("form").enctype,html5Clone:c.createElement("nav").cloneNode(!0).outerHTML!=="<:nav></:nav>",submitBubbles:!0,changeBubbles:!0,focusinBubbles:!1,deleteExpando:!0,noCloneEvent:!0,inlineBlockNeedsLayout:!1,shrinkWrapBlocks:!1,reliableMarginRight:!0},i.checked=!0,b.noCloneChecked=i.cloneNode(!0).checked,g.disabled=!0,b.optDisabled=!h.disabled;try{delete q.test}catch(s){b.deleteExpando=!1}!q.addEventListener&&q.attachEvent&&q.fireEvent&&(q.attachEvent("onclick",function(){b.noCloneEvent=!1}),q.cloneNode(!0).fireEvent("onclick")),i=c.createElement("input"),i.value="t",i.setAttribute("type","radio"),b.radioValue=i.value==="t",i.setAttribute("checked","checked"),q.appendChild(i),k=c.createDocumentFragment(),k.appendChild(q.lastChild),b.checkClone=k.cloneNode(!0).cloneNode(!0).lastChild.checked,b.appendChecked=i.checked,k.removeChild(i),k.appendChild(q),q.innerHTML="",a.getComputedStyle&&(j=c.createElement("div"),j.style.width="0",j.style.marginRight="0",q.style.width="2px",q.appendChild(j),b.reliableMarginRight=(parseInt((a.getComputedStyle(j,null)||{marginRight:0}).marginRight,10)||0)===0);if(q.attachEvent)for(o in{submit:1,change:1,focusin:1})n="on"+o,p=n in q,p||(q.setAttribute(n,"return;"),p=typeof q[n]=="function"),b[o+"Bubbles"]=p;k.removeChild(q),k=g=h=j=q=i=null,f(function(){var a,d,e,g,h,i,j,k,m,n,o,r=c.getElementsByTagName("body")[0];!r||(j=1,k="position:absolute;top:0;left:0;width:1px;height:1px;margin:0;",m="visibility:hidden;border:0;",n="style='"+k+"border:5px solid #000;padding:0;'",o="<div "+n+"><div></div></div>"+"<table "+n+" cellpadding='0' cellspacing='0'>"+"<tr><td></td></tr></table>",a=c.createElement("div"),a.style.cssText=m+"width:0;height:0;position:static;top:0;margin-top:"+j+"px",r.insertBefore(a,r.firstChild),q=c.createElement("div"),a.appendChild(q),q.innerHTML="<table><tr><td style='padding:0;border:0;display:none'></td><td>t</td></tr></table>",l=q.getElementsByTagName("td"),p=l[0].offsetHeight===0,l[0].style.display="",l[1].style.display="none",b.reliableHiddenOffsets=p&&l[0].offsetHeight===0,q.innerHTML="",q.style.width=q.style.paddingLeft="1px",f.boxModel=b.boxModel=q.offsetWidth===2,typeof q.style.zoom!="undefined"&&(q.style.display="inline",q.style.zoom=1,b.inlineBlockNeedsLayout=q.offsetWidth===2,q.style.display="",q.innerHTML="<div style='width:4px;'></div>",b.shrinkWrapBlocks=q.offsetWidth!==2),q.style.cssText=k+m,q.innerHTML=o,d=q.firstChild,e=d.firstChild,h=d.nextSibling.firstChild.firstChild,i={doesNotAddBorder:e.offsetTop!==5,doesAddBorderForTableAndCells:h.offsetTop===5},e.style.position="fixed",e.style.top="20px",i.fixedPosition=e.offsetTop===20||e.offsetTop===15,e.style.position=e.style.top="",d.style.overflow="hidden",d.style.position="relative",i.subtractsBorderForOverflowNotVisible=e.offsetTop===-5,i.doesNotIncludeMarginInBodyOffset=r.offsetTop!==j,r.removeChild(a),q=a=null,f.extend(b,i))});return b}();var j=/^(?:\{.*\}|\[.*\])$/,k=/([A-Z])/g;f.extend({cache:{},uuid:0,expando:"jQuery"+(f.fn.jquery+Math.random()).replace(/\D/g,""),noData:{embed:!0,object:"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000",applet:!0},hasData:function(a){a=a.nodeType?f.cache[a[f.expando]]:a[f.expando];return!!a&&!m(a)},data:function(a,c,d,e){if(!!f.acceptData(a)){var g,h,i,j=f.expando,k=typeof c=="string",l=a.nodeType,m=l?f.cache:a,n=l?a[j]:a[j]&&j,o=c==="events";if((!n||!m[n]||!o&&!e&&!m[n].data)&&k&&d===b)return;n||(l?a[j]=n=++f.uuid:n=j),m[n]||(m[n]={},l||(m[n].toJSON=f.noop));if(typeof c=="object"||typeof c=="function")e?m[n]=f.extend(m[n],c):m[n].data=f.extend(m[n].data,c);g=h=m[n],e||(h.data||(h.data={}),h=h.data),d!==b&&(h[f.camelCase(c)]=d);if(o&&!h[c])return g.events;k?(i=h[c],i==null&&(i=h[f.camelCase(c)])):i=h;return i}},removeData:function(a,b,c){if(!!f.acceptData(a)){var d,e,g,h=f.expando,i=a.nodeType,j=i?f.cache:a,k=i?a[h]:h;if(!j[k])return;if(b){d=c?j[k]:j[k].data;if(d){f.isArray(b)||(b in d?b=[b]:(b=f.camelCase(b),b in d?b=[b]:b=b.split(" ")));for(e=0,g=b.length;e<g;e++)delete d[b[e]];if(!(c?m:f.isEmptyObject)(d))return}}if(!c){delete j[k].data;if(!m(j[k]))return}f.support.deleteExpando||!j.setInterval?delete j[k]:j[k]=null,i&&(f.support.deleteExpando?delete a[h]:a.removeAttribute?a.removeAttribute(h):a[h]=null)}},_data:function(a,b,c){return f.data(a,b,c,!0)},acceptData:function(a){if(a.nodeName){var b=f.noData[a.nodeName.toLowerCase()];if(b)return b!==!0&&a.getAttribute("classid")===b}return!0}}),f.fn.extend({data:function(a,c){var d,e,g,h=null;if(typeof a=="undefined"){if(this.length){h=f.data(this[0]);if(this[0].nodeType===1&&!f._data(this[0],"parsedAttrs")){e=this[0].attributes;for(var i=0,j=e.length;i<j;i++)g=e[i].name,g.indexOf("data-")===0&&(g=f.camelCase(g.substring(5)),l(this[0],g,h[g]));f._data(this[0],"parsedAttrs",!0)}}return h}if(typeof a=="object")return this.each(function(){f.data(this,a)});d=a.split("."),d[1]=d[1]?"."+d[1]:"";if(c===b){h=this.triggerHandler("getData"+d[1]+"!",[d[0]]),h===b&&this.length&&(h=f.data(this[0],a),h=l(this[0],a,h));return h===b&&d[1]?this.data(d[0]):h}return this.each(function(){var b=f(this),e=[d[0],c];b.triggerHandler("setData"+d[1]+"!",e),f.data(this,a,c),b.triggerHandler("changeData"+d[1]+"!",e)})},removeData:function(a){return this.each(function(){f.removeData(this,a)})}}),f.extend({_mark:function(a,b){a&&(b=(b||"fx")+"mark",f._data(a,b,(f._data(a,b)||0)+1))},_unmark:function(a,b,c){a!==!0&&(c=b,b=a,a=!1);if(b){c=c||"fx";var d=c+"mark",e=a?0:(f._data(b,d)||1)-1;e?f._data(b,d,e):(f.removeData(b,d,!0),n(b,c,"mark"))}},queue:function(a,b,c){var d;if(a){b=(b||"fx")+"queue",d=f._data(a,b),c&&(!d||f.isArray(c)?d=f._data(a,b,f.makeArray(c)):d.push(c));return d||[]}},dequeue:function(a,b){b=b||"fx";var c=f.queue(a,b),d=c.shift(),e={};d==="inprogress"&&(d=c.shift()),d&&(b==="fx"&&c.unshift("inprogress"),f._data(a,b+".run",e),d.call(a,function(){f.dequeue(a,b)},e)),c.length||(f.removeData(a,b+"queue "+b+".run",!0),n(a,b,"queue"))}}),f.fn.extend({queue:function(a,c){typeof a!="string"&&(c=a,a="fx");if(c===b)return f.queue(this[0],a);return this.each(function(){var b=f.queue(this,a,c);a==="fx"&&b[0]!=="inprogress"&&f.dequeue(this,a)})},dequeue:function(a){return this.each(function(){f.dequeue(this,a)})},delay:function(a,b){a=f.fx?f.fx.speeds[a]||a:a,b=b||"fx";return this.queue(b,function(b,c){var d=setTimeout(b,a);c.stop=function(){clearTimeout(d)}})},clearQueue:function(a){return this.queue(a||"fx",[])},promise:function(a,c){function m(){--h||d.resolveWith(e,[e])}typeof a!="string"&&(c=a,a=b),a=a||"fx";var d=f.Deferred(),e=this,g=e.length,h=1,i=a+"defer",j=a+"queue",k=a+"mark",l;while(g--)if(l=f.data(e[g],i,b,!0)||(f.data(e[g],j,b,!0)||f.data(e[g],k,b,!0))&&f.data(e[g],i,f.Callbacks("once memory"),!0))h++,l.add(m);m();return d.promise()}});var o=/[\n\t\r]/g,p=/\s+/,q=/\r/g,r=/^(?:button|input)$/i,s=/^(?:button|input|object|select|textarea)$/i,t=/^a(?:rea)?$/i,u=/^(?:autofocus|autoplay|async|checked|controls|defer|disabled|hidden|loop|multiple|open|readonly|required|scoped|selected)$/i,v=f.support.getSetAttribute,w,x,y;f.fn.extend({attr:function(a,b){return f.access(this,a,b,!0,f.attr)},removeAttr:function(a){return this.each(function(){f.removeAttr(this,a)})},prop:function(a,b){return f.access(this,a,b,!0,f.prop)},removeProp:function(a){a=f.propFix[a]||a;return this.each(function(){try{this[a]=b,delete this[a]}catch(c){}})},addClass:function(a){var b,c,d,e,g,h,i;if(f.isFunction(a))return this.each(function(b){f(this).addClass(a.call(this,b,this.className))});if(a&&typeof a=="string"){b=a.split(p);for(c=0,d=this.length;c<d;c++){e=this[c];if(e.nodeType===1)if(!e.className&&b.length===1)e.className=a;else{g=" "+e.className+" ";for(h=0,i=b.length;h<i;h++)~g.indexOf(" "+b[h]+" ")||(g+=b[h]+" ");e.className=f.trim(g)}}}return this},removeClass:function(a){var c,d,e,g,h,i,j;if(f.isFunction(a))return this.each(function(b){f(this).removeClass(a.call(this,b,this.className))});if(a&&typeof a=="string"||a===b){c=(a||"").split(p);for(d=0,e=this.length;d<e;d++){g=this[d];if(g.nodeType===1&&g.className)if(a){h=(" "+g.className+" ").replace(o," ");for(i=0,j=c.length;i<j;i++)h=h.replace(" "+c[i]+" "," ");g.className=f.trim(h)}else g.className=""}}return this},toggleClass:function(a,b){var c=typeof a,d=typeof b=="boolean";if(f.isFunction(a))return this.each(function(c){f(this).toggleClass(a.call(this,c,this.className,b),b)});return this.each(function(){if(c==="string"){var e,g=0,h=f(this),i=b,j=a.split(p);while(e=j[g++])i=d?i:!h.hasClass(e),h[i?"addClass":"removeClass"](e)}else if(c==="undefined"||c==="boolean")this.className&&f._data(this,"__className__",this.className),this.className=this.className||a===!1?"":f._data(this,"__className__")||""})},hasClass:function(a){var b=" "+a+" ",c=0,d=this.length;for(;c<d;c++)if(this[c].nodeType===1&&(" "+this[c].className+" ").replace(o," ").indexOf(b)>-1)return!0;return!1},val:function(a){var c,d,e,g=this[0];{if(!!arguments.length){e=f.isFunction(a);return this.each(function(d){var g=f(this),h;if(this.nodeType===1){e?h=a.call(this,d,g.val()):h=a,h==null?h="":typeof h=="number"?h+="":f.isArray(h)&&(h=f.map(h,function(a){return a==null?"":a+""})),c=f.valHooks[this.nodeName.toLowerCase()]||f.valHooks[this.type];if(!c||!("set"in c)||c.set(this,h,"value")===b)this.value=h}})}if(g){c=f.valHooks[g.nodeName.toLowerCase()]||f.valHooks[g.type];if(c&&"get"in c&&(d=c.get(g,"value"))!==b)return d;d=g.value;return typeof d=="string"?d.replace(q,""):d==null?"":d}}}}),f.extend({valHooks:{option:{get:function(a){var b=a.attributes.value;return!b||b.specified?a.value:a.text}},select:{get:function(a){var b,c,d,e,g=a.selectedIndex,h=[],i=a.options,j=a.type==="select-one";if(g<0)return null;c=j?g:0,d=j?g+1:i.length;for(;c<d;c++){e=i[c];if(e.selected&&(f.support.optDisabled?!e.disabled:e.getAttribute("disabled")===null)&&(!e.parentNode.disabled||!f.nodeName(e.parentNode,"optgroup"))){b=f(e).val();if(j)return b;h.push(b)}}if(j&&!h.length&&i.length)return f(i[g]).val();return h},set:function(a,b){var c=f.makeArray(b);f(a).find("option").each(function(){this.selected=f.inArray(f(this).val(),c)>=0}),c.length||(a.selectedIndex=-1);return c}}},attrFn:{val:!0,css:!0,html:!0,text:!0,data:!0,width:!0,height:!0,offset:!0},attr:function(a,c,d,e){var g,h,i,j=a.nodeType;if(!!a&&j!==3&&j!==8&&j!==2){if(e&&c in f.attrFn)return f(a)[c](d);if(typeof a.getAttribute=="undefined")return f.prop(a,c,d);i=j!==1||!f.isXMLDoc(a),i&&(c=c.toLowerCase(),h=f.attrHooks[c]||(u.test(c)?x:w));if(d!==b){if(d===null){f.removeAttr(a,c);return}if(h&&"set"in h&&i&&(g=h.set(a,d,c))!==b)return g;a.setAttribute(c,""+d);return d}if(h&&"get"in h&&i&&(g=h.get(a,c))!==null)return g;g=a.getAttribute(c);return g===null?b:g}},removeAttr:function(a,b){var c,d,e,g,h=0;if(b&&a.nodeType===1){d=b.toLowerCase().split(p),g=d.length;for(;h<g;h++)e=d[h],e&&(c=f.propFix[e]||e,f.attr(a,e,""),a.removeAttribute(v?e:c),u.test(e)&&c in a&&(a[c]=!1))}},attrHooks:{type:{set:function(a,b){if(r.test(a.nodeName)&&a.parentNode)f.error("type property can't be changed");else if(!f.support.radioValue&&b==="radio"&&f.nodeName(a,"input")){var c=a.value;a.setAttribute("type",b),c&&(a.value=c);return b}}},value:{get:function(a,b){if(w&&f.nodeName(a,"button"))return w.get(a,b);return b in a?a.value:null},set:function(a,b,c){if(w&&f.nodeName(a,"button"))return w.set(a,b,c);a.value=b}}},propFix:{tabindex:"tabIndex",readonly:"readOnly","for":"htmlFor","class":"className",maxlength:"maxLength",cellspacing:"cellSpacing",cellpadding:"cellPadding",rowspan:"rowSpan",colspan:"colSpan",usemap:"useMap",frameborder:"frameBorder",contenteditable:"contentEditable"},prop:function(a,c,d){var e,g,h,i=a.nodeType;if(!!a&&i!==3&&i!==8&&i!==2){h=i!==1||!f.isXMLDoc(a),h&&(c=f.propFix[c]||c,g=f.propHooks[c]);return d!==b?g&&"set"in g&&(e=g.set(a,d,c))!==b?e:a[c]=d:g&&"get"in g&&(e=g.get(a,c))!==null?e:a[c]}},propHooks:{tabIndex:{get:function(a){var c=a.getAttributeNode("tabindex");return c&&c.specified?parseInt(c.value,10):s.test(a.nodeName)||t.test(a.nodeName)&&a.href?0:b}}}}),f.attrHooks.tabindex=f.propHooks.tabIndex,x={get:function(a,c){var d,e=f.prop(a,c);return e===!0||typeof e!="boolean"&&(d=a.getAttributeNode(c))&&d.nodeValue!==!1?c.toLowerCase():b},set:function(a,b,c){var d;b===!1?f.removeAttr(a,c):(d=f.propFix[c]||c,d in a&&(a[d]=!0),a.setAttribute(c,c.toLowerCase()));return c}},v||(y={name:!0,id:!0},w=f.valHooks.button={get:function(a,c){var d;d=a.getAttributeNode(c);return d&&(y[c]?d.nodeValue!=="":d.specified)?d.nodeValue:b},set:function(a,b,d){var e=a.getAttributeNode(d);e||(e=c.createAttribute(d),a.setAttributeNode(e));return e.nodeValue=b+""}},f.attrHooks.tabindex.set=w.set,f.each(["width","height"],function(a,b){f.attrHooks[b]=f.extend(f.attrHooks[b],{set:function(a,c){if(c===""){a.setAttribute(b,"auto");return c}}})}),f.attrHooks.contenteditable={get:w.get,set:function(a,b,c){b===""&&(b="false"),w.set(a,b,c)}}),f.support.hrefNormalized||f.each(["href","src","width","height"],function(a,c){f.attrHooks[c]=f.extend(f.attrHooks[c],{get:function(a){var d=a.getAttribute(c,2);return d===null?b:d}})}),f.support.style||(f.attrHooks.style={get:function(a){return a.style.cssText.toLowerCase()||b},set:function(a,b){return a.style.cssText=""+b}}),f.support.optSelected||(f.propHooks.selected=f.extend(f.propHooks.selected,{get:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex);return null}})),f.support.enctype||(f.propFix.enctype="encoding"),f.support.checkOn||f.each(["radio","checkbox"],function(){f.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var z=/^(?:textarea|input|select)$/i,A=/^([^\.]*)?(?:\.(.+))?$/,B=/\bhover(\.\S+)?\b/,C=/^key/,D=/^(?:mouse|contextmenu)|click/,E=/^(?:focusinfocus|focusoutblur)$/,F=/^(\w*)(?:#([\w\-]+))?(?:\.([\w\-]+))?$/,G=function(a){var b=F.exec(a);b&&(b[1]=(b[1]||"").toLowerCase(),b[3]=b[3]&&new RegExp("(?:^|\\s)"+b[3]+"(?:\\s|$)"));return b},H=function(a,b){var c=a.attributes||{};return(!b[1]||a.nodeName.toLowerCase()===b[1])&&(!b[2]||(c.id||{}).value===b[2])&&(!b[3]||b[3].test((c["class"]||{}).value))},I=function(a){return f.event.special.hover?a:a.replace(B,"mouseenter$1 mouseleave$1")};
@@ -1655,7 +1631,6 @@ Mizuho.initializeTopBar = $.proxy(function() {
 	var isMobileDevice = this.isMobileDevice();
 	var timerId;
 	
-	// Create the floating table of contents used in the top bar.
 	var $floattoc = $('<div id="floattoc"></div>').html($('#toc').html());
 	$floattoc.find('#toctitle').remove();
 	$floattoc.find('.comments').remove();
@@ -1674,8 +1649,6 @@ Mizuho.initializeTopBar = $.proxy(function() {
 		self.internalLinkClicked(this, event);
 	});
 	
-	// Callback for when the user clicks on the Table of Contents
-	// button on the top bar.
 	function showFloatingToc() {
 		var scrollUpdateTimerId;
 		
@@ -1768,9 +1741,6 @@ Mizuho.initializeTopBar = $.proxy(function() {
 		$window.bind('scroll', onScroll);
 	}
 	
-	// Called whenever the user scrolls. Updates the title of the
-	// Table of Contents button in the top bar to the section that
-	// the user is currently reading.
 	function update() {
 		if ($title.offset().top + $title.height() < $document.scrollTop()) {
 			if (!$topbar.is(':visible')) {
@@ -1814,7 +1784,6 @@ Mizuho.initializeTopBar = $.proxy(function() {
 		}, 100);
 	}
 	
-	
 	if (isMobileDevice) {
 		// Mobile devices don't support position fixed.
 		$topbar.css('position', 'absolute');
@@ -1829,5 +1798,5 @@ Mizuho.initializeTopBar = $.proxy(function() {
 $(document).ready(Mizuho.initializeTopBar);
 
 </script>
-</body>
+</body>
 </html>