{"action":"created","issue":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/18","labels_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/18/comments","events_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/18/events","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/18","id":118958359,"number":18,"title":"[WIP] mod_process_securityのwebdav対応","user":{"login":"k0u5uk3","id":2697211,"avatar_url":"https://avatars.githubusercontent.com/u/2697211?v=3","gravatar_id":"","url":"https://api.github.com/users/k0u5uk3","html_url":"https://github.com/k0u5uk3","followers_url":"https://api.github.com/users/k0u5uk3/followers","following_url":"https://api.github.com/users/k0u5uk3/following{/other_user}","gists_url":"https://api.github.com/users/k0u5uk3/gists{/gist_id}","starred_url":"https://api.github.com/users/k0u5uk3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k0u5uk3/subscriptions","organizations_url":"https://api.github.com/users/k0u5uk3/orgs","repos_url":"https://api.github.com/users/k0u5uk3/repos","events_url":"https://api.github.com/users/k0u5uk3/events{/privacy}","received_events_url":"https://api.github.com/users/k0u5uk3/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-11-26T02:14:20Z","updated_at":"2015-11-26T09:11:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/pulls/18","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/18","diff_url":"https://github.com/matsumoto-r/mod_process_security/pull/18.diff","patch_url":"https://github.com/matsumoto-r/mod_process_security/pull/18.patch"},"body":"# 関連情報\r\n\r\n * https://github.com/matsumoto-r/mod_process_security/pull/16\r\n * https://github.com/matsumoto-r/mod_process_security/pull/17\r\n\r\n# 対応手法\r\n\r\nwebdavはapacheのレスポンス生成時にmod_davに制御が移りmod_davの処理により機能が提供される。mod_process_securityはレスポンス生成時の一番早い段階に権限委譲を行うため、mod_davとの相性は良いが、mod_process_securityにはリクエストにより処理されるファイルのチェックやsuexecとの兼ね合いなどのチェックが入っており、既存のコードでは共存できない。\r\n\r\nそこで既存のwebdavを考慮しないスタンダードモードと、webdavを考慮したwebdavモードに処理を分けて、webdavモード時にはファイルチェックやsuexecのチェックなどを行わないようにした。\r\n\r\n本修正により、PSDavEnableとPSDavUidGidの2つのオプションが追加された。PSDavEnableはmod_process_securityのwebdavモードを適用するためのフラグであり、PSDavUidGidはmod_process_securityがwebdav関連の操作を行う時の権限移譲先のuidとgidである。\r\n\r\n# Apacheの設定例\r\n\r\n```\r\n<VirtualHost *:80>\r\n<IfModule mod_process_security.c>\r\nPSExAll On\r\nPSDavEnable On\r\nPSDavUidGid 1001 1001\r\n</IfModule>\r\n\r\nServerAdmin webmaster@localhost\r\nDocumentRoot /var/www/webdav\r\nServerName mps-webdav.net\r\nDAVLockDB /var/www/webdav/.dav\r\n\r\n<Directory /var/www/webdav>\r\nRequire all granted\r\nDAV On\r\n</Directory>\r\n\r\n</VirtualHost>\r\n```\r\n\r\n上記設定ではmps-webdav.netにwebdavクライアントがアクセスするとサーバ内の/var/www/webdavディレクトリ以下はwebdavで制御され、その際の権限はuid,gid共に1001になる。\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/comments/159854036","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/18#issuecomment-159854036","issue_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/18","id":159854036,"user":{"login":"k0u5uk3","id":2697211,"avatar_url":"https://avatars.githubusercontent.com/u/2697211?v=3","gravatar_id":"","url":"https://api.github.com/users/k0u5uk3","html_url":"https://github.com/k0u5uk3","followers_url":"https://api.github.com/users/k0u5uk3/followers","following_url":"https://api.github.com/users/k0u5uk3/following{/other_user}","gists_url":"https://api.github.com/users/k0u5uk3/gists{/gist_id}","starred_url":"https://api.github.com/users/k0u5uk3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k0u5uk3/subscriptions","organizations_url":"https://api.github.com/users/k0u5uk3/orgs","repos_url":"https://api.github.com/users/k0u5uk3/repos","events_url":"https://api.github.com/users/k0u5uk3/events{/privacy}","received_events_url":"https://api.github.com/users/k0u5uk3/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T09:11:13Z","updated_at":"2015-11-26T09:11:13Z","body":"# 性能に影響がないことを確認する。\r\n\r\n * テスト用のapache configを用意する\r\n\r\n```\r\n\r\nPHPIniDir \"/usr/local/lib/php/php.ini\"\r\nAddType application/x-httpd-php .php\r\nLoadModule process_security_module   modules/mod_process_security.so\r\n\r\n<VirtualHost *:80>\r\n<IfModule mod_process_security.c>\r\nPSExAll On\r\n</IfModule>\r\n\r\nServerName mps-test.net\r\nDocumentRoot /var/www/test/\r\nDirectoryIndex index.php index.html\r\nErrorLog /usr/local/apache2/logs/test-error.log\r\nTransferLog /usr/local/apache2/logs/test-access.log\r\n\r\n<Directory /var/www/test>\r\n   Options FollowSymLinks\r\n   Require all granted\r\n</Directory>\r\n</VirtualHost>\r\n```\r\n\r\n * info.phpを用意する\r\n\r\n```\r\necho \"<?php phpinfo(); ?>\" > info.php\r\n```\r\n\r\n * 修正前のmod_process_securityを通してのベンチマークを取得する。\r\n\r\n```\r\nab -c 100 -n 10000 mps-test.net/info.php\r\nThis is ApacheBench, Version 2.3 <$Revision: 1663405 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking mps-test.net (be patient)\r\nCompleted 1000 requests\r\nCompleted 2000 requests\r\nCompleted 3000 requests\r\nCompleted 4000 requests\r\nCompleted 5000 requests\r\nCompleted 6000 requests\r\nCompleted 7000 requests\r\nCompleted 8000 requests\r\nCompleted 9000 requests\r\nCompleted 10000 requests\r\nFinished 10000 requests\r\n\r\n\r\nServer Software:        Apache/2.4.17\r\nServer Hostname:        mps-test.net\r\nServer Port:            80\r\n\r\nDocument Path:          /info.php\r\nDocument Length:        84219 bytes\r\n\r\nConcurrency Level:      100\r\nTime taken for tests:   24.913 seconds\r\nComplete requests:      10000\r\nFailed requests:        882\r\n   (Connect: 0, Receive: 0, Length: 882, Exceptions: 0)\r\nTotal transferred:      844009063 bytes\r\nHTML transferred:       842189063 bytes\r\nRequests per second:    401.40 [#/sec] (mean)\r\nTime per request:       249.130 [ms] (mean)\r\nTime per request:       2.491 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          33084.20 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    1   4.1      0     124\r\nProcessing:     3  248 141.6    215    3068\r\nWaiting:        2  185  88.6    149    2997\r\nTotal:          3  249 141.8    216    3080\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%    216\r\n  66%    256\r\n  75%    325\r\n  80%    357\r\n  90%    430\r\n  95%    495\r\n  98%    594\r\n  99%    712\r\n 100%   3080 (longest request)\r\n```\r\n\r\n * 修正後のmod_process_securityを通してのベンチマークを取得する\r\n\r\n```\r\n ab -c 100 -n 10000 mps-test.net/info.php\r\nThis is ApacheBench, Version 2.3 <$Revision: 1663405 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking mps-test.net (be patient)\r\nCompleted 1000 requests\r\nCompleted 2000 requests\r\nCompleted 3000 requests\r\nCompleted 4000 requests\r\nCompleted 5000 requests\r\nCompleted 6000 requests\r\nCompleted 7000 requests\r\nCompleted 8000 requests\r\nCompleted 9000 requests\r\nCompleted 10000 requests\r\nFinished 10000 requests\r\n\r\n\r\nServer Software:        Apache/2.4.17\r\nServer Hostname:        mps-test.net\r\nServer Port:            80\r\n\r\nDocument Path:          /info.php\r\nDocument Length:        84219 bytes\r\n\r\nConcurrency Level:      100\r\nTime taken for tests:   25.649 seconds\r\nComplete requests:      10000\r\nFailed requests:        911\r\n   (Connect: 0, Receive: 0, Length: 911, Exceptions: 0)\r\nTotal transferred:      844008994 bytes\r\nHTML transferred:       842188994 bytes\r\nRequests per second:    389.87 [#/sec] (mean)\r\nTime per request:       256.493 [ms] (mean)\r\nTime per request:       2.565 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          32134.56 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    1   3.6      0     119\r\nProcessing:     5  255 164.2    208    3545\r\nWaiting:        5  193 117.4    151    3473\r\nTotal:          6  256 164.2    209    3554\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%    209\r\n  66%    257\r\n  75%    332\r\n  80%    365\r\n  90%    450\r\n  95%    541\r\n  98%    753\r\n  99%    814\r\n 100%   3554 (longest request)\r\n```\r\n\r\n * まとめ\r\n\r\n修正前のmod_process_securityのRequest Per\r\nsecoundは401.40であり修正後のmod_process_securityでは389.87に成った。\r\n通常処理の性能に大きな違いは見られないと判断する。\r\n\r\n\r\n"}}