Additional suexec tuning and login.conf support in suexec

Submitted by:   Alexander Yurchenko <grange@rt.mipt.ru>

3 files changed, 98 insertions, 1 deletions

diff --git a/www/apache13/Makefile b/www/apache13/Makefile
index fbe0d88..7eaa891 100644
--- a/www/apache13/Makefile
+++ b/www/apache13/Makefile
@@ -7,6 +7,7 @@
 
 PORTNAME=	apache
 PORTVERSION=    1.3.27
+PORTREVISION=   1
 CATEGORIES=	www
 MASTER_SITES=   http://www.apache.org/dist/httpd/ \
 		ftp://ftp.ccs.neu.edu/net/mirrors/ftp.apache.org/apache/dist/httpd/ \
@@ -39,6 +40,7 @@ DEFAULT_PATH=/bin:/usr/bin:${PREFIX}/bin
 .if defined(WITH_APACHE_SUEXEC) && ${WITH_APACHE_SUEXEC} == yes
 
 APACHE_SUEXEC_DOCROOT?=${DOCUMENT_ROOT}
+APACHE_SUEXEC_LOG?=/var/log/httpd-suexec.log
 APACHE_SUEXEC_USERDIR?=public_html
 
 SUEXEC_CONF= \
@@ -47,7 +49,7 @@ SUEXEC_CONF= \
 	--suexec-caller=www \
 	--suexec-uidmin=1000 \
 	--suexec-gidmin=1000 \
-	--suexec-logfile=/var/log/httpd-suexec.log \
+	--suexec-logfile=${APACHE_SUEXEC_LOG} \
 	--suexec-userdir=${APACHE_SUEXEC_USERDIR} \
 	--suexec-safepath=${DEFAULT_PATH}
 
diff --git a/www/apache13/files/patch-ba b/www/apache13/files/patch-ba
new file mode 100644
index 0000000..1f92bd3
--- /dev/null
+++ b/www/apache13/files/patch-ba
@@ -0,0 +1,20 @@
+--- src/support/Makefile.tmpl.orig	Sat Mar  2 20:46:23 2002
++++ src/support/Makefile.tmpl	Tue Oct 22 00:31:18 2002
+@@ -7,7 +7,7 @@
+ # LIBS=-L$(SSLLOC)/lib -lssl -lcrypto -lm -lap -los $(EXTRA_LIBS) $(LIBS1)
+ # INCLUDES=-I$(SSLLOC)/include $(INCLUDES1) $(INCLUDES0) $(EXTRA_INCLUDES)
+ 
+-CFLAGS=$(OPTIM) $(CFLAGS1) $(EXTRA_CFLAGS)
++CFLAGS=-DLOGIN_CAP $(OPTIM) $(CFLAGS1) $(EXTRA_CFLAGS)
+ LIBS=-lm -lap -los $(EXTRA_LIBS) $(LIBS1)
+ INCLUDES=$(INCLUDES1) $(INCLUDES0) $(EXTRA_INCLUDES)
+ LDFLAGS=$(LDFLAGS1) $(EXTRA_LDFLAGS) -L$(OSDIR) -L$(SRCDIR)/ap
+@@ -50,7 +50,7 @@
+ 	    -e 's%@LIBS_SHLIB@%$(LIBS_SHLIB)%g' && chmod a+x apxs
+ 
+ suexec: suexec.o
+-	$(CC) $(CFLAGS) -o suexec $(LDFLAGS) suexec.o $(LIBS)
++	$(CC) $(CFLAGS) -lutil -o suexec $(LDFLAGS) suexec.o $(LIBS)
+ 
+ clean:
+ 	rm -f $(TARGETS) *.o
diff --git a/www/apache13/files/patch-bb b/www/apache13/files/patch-bb
new file mode 100644
index 0000000..1f2731e
--- /dev/null
+++ b/www/apache13/files/patch-bb
@@ -0,0 +1,75 @@
+--- src/support/suexec.c.orig	Thu Mar 14 00:05:37 2002
++++ src/support/suexec.c	Wed Sep 25 00:22:18 2002
+@@ -90,6 +90,9 @@
+ #include <sys/types.h>
+ 
+ #include <stdarg.h>
++#ifdef LOGIN_CAP
++#include <login_cap.h>
++#endif
+ 
+ #include "suexec.h"
+ 
+@@ -296,11 +299,14 @@
+         fprintf(stderr, " -D DOC_ROOT=\"%s\"\n", DOC_ROOT);
+ #endif
+ #ifdef GID_MIN
+-        fprintf(stderr, " -D GID_MID=%d\n", GID_MIN);
++        fprintf(stderr, " -D GID_MIN=%d\n", GID_MIN);
+ #endif
+ #ifdef HTTPD_USER
+         fprintf(stderr, " -D HTTPD_USER=\"%s\"\n", HTTPD_USER);
+ #endif
++#ifdef LOGIN_CAP
++        fprintf(stderr, " -D LOGIN_CAP\n");
++#endif
+ #ifdef LOG_EXEC
+         fprintf(stderr, " -D LOG_EXEC=\"%s\"\n", LOG_EXEC);
+ #endif
+@@ -311,7 +317,7 @@
+         fprintf(stderr, " -D SUEXEC_UMASK=%03o\n", SUEXEC_UMASK);
+ #endif
+ #ifdef UID_MIN
+-        fprintf(stderr, " -D UID_MID=%d\n", UID_MIN);
++        fprintf(stderr, " -D UID_MIN=%d\n", UID_MIN);
+ #endif
+ #ifdef USERDIR_SUFFIX
+         fprintf(stderr, " -D USERDIR_SUFFIX=\"%s\"\n", USERDIR_SUFFIX);
+@@ -461,7 +467,28 @@
+ 
+     /*
+      * Change UID/GID here so that the following tests work over NFS.
+-     *
++     */
++
++#ifdef LOGIN_CAP
++    /*
++     * Set user context (resources, priority and grouplist).
++     * If unsuccessful, error out.
++     */
++    if (setusercontext(NULL, pw, uid, LOGIN_SETRESOURCES | LOGIN_SETPRIORITY |
++      LOGIN_SETGROUP | LOGIN_SETLOGIN) == -1) {
++	log_err("emerg: failed to set user context (%ld: %s)\n", uid, cmd);
++	exit(108);
++    }
++
++    /*
++     * Set gid to the target group. If unsuccessful, error out.
++     */
++    if ((setgid(gid)) != 0) {
++	log_err("emerg: failed to setgid (%ld: %s)\n", gid, cmd);
++	exit(109);
++    }
++#else /* !LOGIN_CAP */
++    /*
+      * Initialize the group access list for the target user,
+      * and setgid() to the target group. If unsuccessful, error out.
+      */
+@@ -469,6 +496,7 @@
+ 	log_err("emerg: failed to setgid (%ld: %s)\n", gid, cmd);
+ 	exit(109);
+     }
++#endif /* LOGIN_CAP */
+ 
+     /*
+      * setuid() to the target user.  Error out on fail.