{"action":"created","issue":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/7","labels_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/7/comments","events_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/7/events","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/7","id":103974155,"number":7,"title":"ケーパビリティの最小化","user":{"login":"k0u5uk3","id":2697211,"avatar_url":"https://avatars.githubusercontent.com/u/2697211?v=3","gravatar_id":"","url":"https://api.github.com/users/k0u5uk3","html_url":"https://github.com/k0u5uk3","followers_url":"https://api.github.com/users/k0u5uk3/followers","following_url":"https://api.github.com/users/k0u5uk3/following{/other_user}","gists_url":"https://api.github.com/users/k0u5uk3/gists{/gist_id}","starred_url":"https://api.github.com/users/k0u5uk3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k0u5uk3/subscriptions","organizations_url":"https://api.github.com/users/k0u5uk3/orgs","repos_url":"https://api.github.com/users/k0u5uk3/repos","events_url":"https://api.github.com/users/k0u5uk3/events{/privacy}","received_events_url":"https://api.github.com/users/k0u5uk3/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-31T02:25:48Z","updated_at":"2015-08-31T07:38:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/pulls/7","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/7","diff_url":"https://github.com/matsumoto-r/mod_process_security/pull/7.diff","patch_url":"https://github.com/matsumoto-r/mod_process_security/pull/7.patch"},"body":"現状のmod_process_securityの動作は以下のように見受けられます。\r\n 1. register_hookにより、apache_moduleの初期化処理としてprocess_security_initが呼ばれる。\r\n 1. process_security_initのprctl(PR_SET_KEEPCAPS,1)命令により、root権限相当のcapabilityが引き継がれる。 \r\n 1. ap_hook_handlerにより、process_security_handlerがセットされ、リクエスト毎にprocess_security_handlerが呼ばれる。\r\n 1. process_security_handlerからprocess_security_thread_handlerがスレッドとして生成される。\r\n 1. process_security_thread_handlerからprocess_security_set_capが呼ばれる。\r\n 1. process_security_capにより、mod_process_securityに最低限必要な権限情報に移行する。\r\n 1. 実際にApacheがリクエストが処理をする。\r\n\r\nこれにより、2から5までの処理の間はroot権限相当の権限を保持したままmod_process_securityは動作すると思います。mod_process_security及び、他のモジュール、またhttpdそのものに脆弱性発生した場合、できうるかぎりroot権限相当の権限を持つ処理を小さくすべきと考え、子プロセス生成時に最小限のケーパビリティに設定を行うPullRequestを送信します。\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/comments/136288749","html_url":"https://github.com/matsumoto-r/mod_process_security/pull/7#issuecomment-136288749","issue_url":"https://api.github.com/repos/matsumoto-r/mod_process_security/issues/7","id":136288749,"user":{"login":"k0u5uk3","id":2697211,"avatar_url":"https://avatars.githubusercontent.com/u/2697211?v=3","gravatar_id":"","url":"https://api.github.com/users/k0u5uk3","html_url":"https://github.com/k0u5uk3","followers_url":"https://api.github.com/users/k0u5uk3/followers","following_url":"https://api.github.com/users/k0u5uk3/following{/other_user}","gists_url":"https://api.github.com/users/k0u5uk3/gists{/gist_id}","starred_url":"https://api.github.com/users/k0u5uk3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k0u5uk3/subscriptions","organizations_url":"https://api.github.com/users/k0u5uk3/orgs","repos_url":"https://api.github.com/users/k0u5uk3/repos","events_url":"https://api.github.com/users/k0u5uk3/events{/privacy}","received_events_url":"https://api.github.com/users/k0u5uk3/received_events","type":"User","site_admin":false},"created_at":"2015-08-31T07:38:34Z","updated_at":"2015-08-31T07:38:34Z","body":"PSModeは整理されるとのことでしたので、```PSCapDacOverride On```というディレクティブを作成しました。\r\nこのディレクティブをONにした状態でapacheを起動すると子プロセスは以下のケーパビリティを持ちます。\r\n```\r\nCapabilities for `5950': = cap_dac_override,cap_setgid,cap_setuid+ep\r\n```\r\nmod_ruidを併用する場合は```PSCapDacOverride On```を使用することでとりあえず逃げ道を用意できるかと存じます。\r\n\r\nよろしくおねがいします。"}}