Apache Module mod_privileges

This module enables different Virtual Hosts to run with different Unix User and Group IDs, and with different Solaris Privileges. In particular, it offers a solution to the problem of privilege separation between different Virtual Hosts, first promised by the abandoned perchild MPM. It also offers other security enhancements.

is not itself an MPM. It works mod_privilegeswithin a processing model to set privileges and User/Group per request in a running process. It is therefore not compatible with a threaded MPM, and will refuse to run under one.

raises security issues similar to those of modprivilegessuexec. But unlike suexec, it applies not only to CGI programs but to the entire request processing cycle, including in-process applications and subprocesses. It is ideally suited to running PHP applications under modphp, which is also incompatible with threaded MPMs. It is also well-suited to other in-process scripting applications such as modperl, modpython, and mod_ruby, and to applications implemented in C as apache modules where privilege separation is an issue.

introduces new security concerns in situations where modprivilegesuntrusted code may be run within the webserver process. This applies to untrusted modules, and scripts running under modules such as modphp or modperl. Scripts running externally (e.g. as CGI or in an appserver behind modproxy or mod_jk) are NOT affected.

directive allows you to select either FAST or SECURE mode. You can mix modes, using FAST mode for trusted users and fully-audited code paths, while imposing SECURE mode where an untrusted user has scope to introduce code.

Before describing the modes, we should also introduce the target use cases: Benign vs Hostile. In a benign situation, you want to separate users for their convenience, and protect them and the server against the risks posed by honest mistakes, but you trust your users are not deliberately subverting system security. In a hostile situation - e.g. commercial hosting - you may have users deliberately attacking the system or each other.

s for each virtual host, and even in a directory context within a virtual host. FAST mode is appropriate where the user(s) are trusted and/or have no privilege to load in-process code. SECURE mode is appropriate to cases where untrusted code might be run in-process. However, even in SECURE mode, there is no protection against a malicious user who is able to introduce privileges-aware code running before the start of the request-processing cycle.

This directive differs slightly between a

context (including equivalents such as Location/Files/If) and a top-level or

At top-level, it sets a default that will be inherited by virtualhosts. In a virtual host, FAST or SECURE mode acts on the entire HTTP request, and any settings in a

context will be ignored. A third pseudo-mode SELECTIVE defers the choice of FAST vs SECURE to directives in a

context, it is applicable only where SELECTIVE mode was set for the VirtualHost. Only FAST or SECURE can be set in this context (SELECTIVE would be meaningless).

context applies to the request. This might give an attacker opportunities to introduce code through a RewriteMap

or modextfilterRewriteMapprog. Note that it does not prevent CGI programs running under alternative process and security models such as mod_fcgid, which is a recommended solution in Solaris.

Secure has the effect of denying privileges to the subprocesses, as described for VHostSecure

. Each privilege-name is the name of a Solaris privilege, such as filesetid or sysnfs.

A privilege-name may optionally be prefixed by + or -, which will respectively allow or deny a privilege. If used with neither + nor -, all privileges otherwise assigned to the virtualhost will be denied. You can use this to override any of the default sets and construct your own privilege set.

This directive can open huge security holes in apache subprocesses, up to and including running them with root-level powers. Do not use it unless you fully understand what you are doing!

Inherits the group id specified in Group

followed by a group number.This directive cannot be used to run apache as root! Nevertheless, it opens potential security issues similar to those discussed in the suexec documentation.

or custom MPM).Determines whether the virtual host processes requests with security enhanced by removal of Privileges that are rarely needed in a webserver, but which are available by default to a normal Unix user and may therefore be required by modules and applications. It is recommended that you retain the default (On) unless it prevents an application running. Since the setting applies to the process, this is not compatible with threaded MPMs.

prevents an application running, this may be a warning sign that the application should be reviewed for security.

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4