Re: [mod-security-users] Re: SecChrootDir in vhost?

[Ivan R. <iv...@we...>]

Rocky Olsen wrote:
> Herm, Bugger.
> 
> Well i guess the question to be asked is, does anyone know of a way to
> chroot apache inside <VirutalHost>'s. Say when a connection comes in for a
> vhost and the parent process spawns the child to handle it, that child
> chroot's itself in the vhost's directory?

   For that to happen you would need to run Apache as root, perform
   chroot and suid on every request, and configure children to die
   after serving only one request. It's perfectly possible, but would
   probably suffer a performance penalty. There are suid modules
   around, but I haven't heard of one that allows chroot too.

   But you can do the following:

   Run a separate Apache instance for each <VirtualHost>, chrooted
   and running as the user. Install one Apache instance in front
   and use it as a reverse proxy. This is a very secure and flexible
   solution but it requires a lot of memory. It is thus only suitable
   when there is a small number of virtual hosts.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org