Apache still falls into Root

nistelrooy · 07-25-2005, 01:13 AM

Hi LinuxQuestion Helpers

Thanks for your time to help me vet this problem.

I'm trying very hard to assign www-data for apache. No matter how many times i restart and modify the httpd.conf (apache.conf), it doesn't seem to be able to go under www-data completely.

Code:

root     22831  0.0  1.5  16192  5920 ?        Ss   Jul23   0:01 /usr/sbin/apache2 -k start -DSSL
www-data 22834  0.0  2.6  20072 10408 ?        S    Jul23   0:13 /usr/sbin/apache2 -k start -DSSL
www-data 22836  0.0  2.8  20320 10880 ?        S    Jul23   0:30 /usr/sbin/apache2 -k start -DSSL
www-data 22839  0.0  2.7  20232 10692 ?        S    Jul23   0:27 /usr/sbin/apache2 -k start -DSSL
www-data 22840  0.0  2.6  20080 10384 ?        S    Jul23   0:23 /usr/sbin/apache2 -k start -DSSL
www-data 30406  0.0  2.8  20320 10876 ?        S    Jul23   0:19 /usr/sbin/apache2 -k start -DSSL

Thanks for your help!

tkedwards · 07-25-2005, 08:57 PM

There is no problem here, your apache is setup correctly. The apache process must start as root so that it can bind to port 80, since you need root access to bind to one of the 'priveleged ports' below 1024. Apache then drops privileges it does this by forking off one or more child processes of itself which run under the apache (or www-data in your case) user. These child processes are the ones that handle the requests from web clients and the root process is effectively a 'stub' process in that its not doing anything.

The fact that these unpriveleged processes are descendents (ie. child, grand-child, great-grand-child etc.) processes of a root process doesn't lessen the security in any way. *ALL* processes on a Linux system are descendents of the 'init' process which runs as root. So the fact that your apache processes are children of a root process would no more enable them to assume root priveleges, even if compromised by a hacker, than I could use the fact that the firefox instance I'm using to write this is a child of the init process to assume root priveleges.