Re^2: How to change the userid of a running external process

Hello Monks,

Thank you for your reply's

What I am trying to do is change an apache child to the user and group id's that matches the vhost when a request comes in.

I managed to do this in mod_perl but the problem is that once changed to a certain userid you cannot go back (which makes sense). and apache had to run as root which is also a bit....

So the only option is to only use the child once and let it die or (and I haven't figured out how to do this) remember which userid a child has and once a next request comes in reuse this child. But this seems impossible in apache since thehe connection get passed to a child and only after wards it gets decided which vhost it should handle.

So I thought it would be nice if I could have a child signal a process running as root and have that process change the childs id and when the child signals it's finished finishes change it back.

In the responses I got so far it seems this is rather impossible or causes very much overhead.

But if anyone has a good suggestion for this it would be appriciated.

Regards

Hans

Comment on Re^2: How to change the userid of a running external process

Replies are listed 'Best First'.
Re^3: How to change the userid of a running external process by afoken (Chancellor) on Jul 22, 2010 at 12:21 UTC
What I am trying to do is change an apache child to the user and group id's that matches the vhost when a request comes in. Why do you think you need to do that? Search the Apache documentation for suexec if you need to run code under a different user ID. Also think about using static FastCGI servers: They can run under any user ID you like, and if they crash, they don't kill the entire webserver. Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply]
Re^4: How to change the userid of a running external process by macron0 (Novice) on Jul 22, 2010 at 20:40 UTC
Suexec and suphp are the reason I am trying this. It gives loads of complications since apache keeps running as apache so generated files (like uploaded images) must have permissions in a way that apache kan read it. And suphp sort of cancels the whole point of php (being fast) and also has many other problems. So any of the cgi options are not what I am looking for. And I use embperl for my own sites I think (but I am not sure) it would all ready be much faster than suphp if I fork a child, change to the userid of the child to what I need and then let the forked child die when it is done, every request. But I still think this solution is a bad idea too. So I am still looking for a way to have a process with root permissions change other processes userids. Help?</?>	[reply]
Re^5: How to change the userid of a running external process by afoken (Chancellor) on Jul 24, 2010 at 18:19 UTC
So I am still looking for a way to have a process with root permissions change other processes userids. No sane operating system will let you do that. Rethink your concept. So any of the cgi options are not what I am looking for. Re-read my previous posting. I mentioned FastCGI servers. FastCGI servers and CGI programs share the three letters C, G, and I, but that's all. The ancient CGI spec and the FastCGI spec are two very different things, sharing barely more than the three letters and the idea of having four communication channels (input stream, output stream, error stream, environment variables). The most obvious difference is that programs running under the ancient CGI spec handle exactly one request and exit, whereas FastCGI servers handle as many request as they like, even in parallel, like mod_perl and other webserver plugins. Searching Google for FastCGI would have told you that. FastCGI servers may be started by the webserver, but they can also be managed by the operating system or daemontools. They can run under every user account you like, each server under a different one if needed. The webserver still can communicate with each of them. PHP can also run as a FastCGI server, or as one FastCGI server per needed user account. Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply]
Re^5: How to change the userid of a running external process by morgon (Priest) on Jul 22, 2010 at 22:04 UTC
Is your problem really about the uids of running processes or is all you really need just that one process can acess the files another process has produced? Maybe it would suffice to have a suid-script that a process can invoke after it has created a file that does a chown so that another process can read it?	[reply]