[packages/apache-mod_mpm_itk] Rel 5; allow static AssignUserID to base http uid under LimitUIDRange
arekm
arekm at pld-linux.org
Fri Sep 4 15:33:50 CEST 2026
commit fa4747a91b2101e6188858c7083a5f0bb1f183ac
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Fri Sep 4 15:30:48 2026 +0200
Rel 5; allow static AssignUserID to base http uid under LimitUIDRange
apache-mod_mpm_itk-README.security | 11 +++++-----
apache-mod_mpm_itk.spec | 2 +-
uid-range-precheck.patch | 45 +++++++++++++++-----------------------
3 files changed, 25 insertions(+), 33 deletions(-)
---
diff --git a/apache-mod_mpm_itk.spec b/apache-mod_mpm_itk.spec
index dcd551d..8dfb1e0 100644
--- a/apache-mod_mpm_itk.spec
+++ b/apache-mod_mpm_itk.spec
@@ -5,7 +5,7 @@
Summary: mod_mpm_itk - allows you to run each of your vhost under a separate uid and gid
Name: apache-mod_mpm_itk
Version: %{ver}.%{subver}
-Release: 4
+Release: 5
License: Apache v2.0
Group: Networking/Daemons/HTTP
Source0: http://mpm-itk.sesse.net/mpm-itk-%{ver}-%{subver}.tar.gz
diff --git a/apache-mod_mpm_itk-README.security b/apache-mod_mpm_itk-README.security
index 743256c..2d0a017 100644
--- a/apache-mod_mpm_itk-README.security
+++ b/apache-mod_mpm_itk-README.security
@@ -21,11 +21,12 @@ What mpm-itk enforces
* LimitUIDRange/LimitGIDRange. A seccomp filter blocks setuid/setgid outside the
configured range (uid/gid 0 is always blocked, and a 0 range floor is rejected
at config time). The filter also permits exactly the base http uid/gid (51) so
- Apache can start; a request may run as that id only through a vhost with no
- AssignUserID - an explicit AssignUserID or an AssignUserIDExpr/AssignGroupIDExpr
- result naming the base user is range-checked like any other, so request data
- cannot select it. User-namespace creation is denied so the range cannot be
- sidestepped. Supplementary groups are filtered to the same gid range, so a
+ Apache can start; a request may run as that id only when the configuration
+ fixes it statically (no AssignUserID, or AssignUserID naming the base user) -
+ an AssignUserIDExpr/AssignGroupIDExpr result naming the base user is
+ range-checked like any other, so request data cannot select it. User-namespace
+ creation is denied so the range cannot be sidestepped. Supplementary groups
+ are filtered to the same gid range, so a
tenant never receives a group (including gid 0) outside it. Leave capabilities
enabled (the default): EnableCapabilities Off makes mod_unixd keep uid 0, which
the filter denies, so the worker would not start.
diff --git a/uid-range-precheck.patch b/uid-range-precheck.patch
index b60452b..6f6d122 100644
--- a/uid-range-precheck.patch
+++ b/uid-range-precheck.patch
@@ -4,51 +4,42 @@
uid_t wanted_uid;
gid_t wanted_gid;
const char *wanted_username;
-+ int uid_from_fallback = 0, gid_from_fallback = 0;
++ int uid_from_expr = 0, gid_from_expr = 0;
int err = 0;
itk_server_conf *sconf =
-@@ -422,6 +423,7 @@
- wanted_uid = ap_unixd_config.user_id;
- wanted_gid = ap_unixd_config.group_id;
- wanted_username = ap_unixd_config.user_name;
-+ uid_from_fallback = gid_from_fallback = 1;
- }
-
- /* AssignUserIDExpr and AssignGroupIDExpr override AssignUserID and defaults. */
-@@ -444,6 +446,7 @@
+@@ -444,6 +445,7 @@
}
wanted_uid = ent->pw_uid;
-+ uid_from_fallback = 0;
++ uid_from_expr = 1;
}
if (dconf->gid_expr != NULL) {
struct group *ent;
-@@ -464,6 +467,32 @@
+@@ -464,6 +466,31 @@
}
wanted_gid = ent->gr_gid;
-+ gid_from_fallback = 0;
++ gid_from_expr = 1;
+ }
+
+ /* Refuse an out-of-range primary uid/gid in plain C, before any credential
+ * change: the normal path must not depend on the seccomp filter (absent on
+ * non-x86), and no partial drop must be started for a misconfigured
-+ * AssignUserID. The base Apache uid/gid is exempt only when it came from
-+ * the no-AssignUserID fallback above: the seccomp base-id exception exists
-+ * for mod_unixd's startup drop, and honouring it for an explicit
-+ * AssignUserID or an AssignUserIDExpr/AssignGroupIDExpr result would let
-+ * request data (an expression built from the Host header, say) select the
-+ * base user below the configured floor. So uid/gid 0 is out of range (a 0
-+ * floor is rejected at config time) unless Apache itself runs as that id
-+ * and the vhost has no AssignUserID. Logged at ERR, not NOTICE: NOTICE is
-+ * below the default LogLevel warn, so the 500 would come with no reason in
-+ * the log.
++ * AssignUserID. The base Apache uid/gid is exempt (mirroring the seccomp
++ * base-id exception) when the configuration fixes it statically - no
++ * AssignUserID, or an AssignUserID naming the base user - but not when an
++ * AssignUserIDExpr/AssignGroupIDExpr produced it: an expression built from
++ * request data (the Host header, say) could otherwise select the base user
++ * below the configured floor. uid/gid 0 is thus out of range (a 0 floor is
++ * rejected at config time) unless Apache itself runs as that id. Logged at
++ * ERR, not NOTICE: NOTICE is below the default LogLevel warn, so the 500
++ * would come with no reason in the log.
+ */
-+ if (!(uid_from_fallback ||
-+ (wanted_uid >= ap_itk_min_uid && wanted_uid <= ap_itk_max_uid)) ||
-+ !(gid_from_fallback ||
-+ (wanted_gid >= ap_itk_min_gid && wanted_gid <= ap_itk_max_gid))) {
++ if (!((wanted_uid >= ap_itk_min_uid && wanted_uid <= ap_itk_max_uid) ||
++ (!uid_from_expr && wanted_uid == ap_unixd_config.user_id)) ||
++ !((wanted_gid >= ap_itk_min_gid && wanted_gid <= ap_itk_max_gid) ||
++ (!gid_from_expr && wanted_gid == ap_unixd_config.group_id))) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+ "AssignUserID uid/gid %u/%u is outside LimitUIDRange/"
+ "LimitGIDRange; refusing the request.",
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/apache-mod_mpm_itk.git/commitdiff/fa4747a91b2101e6188858c7083a5f0bb1f183ac
More information about the pld-cvs-commit
mailing list