From 2b4bc86c70a3dfe61ada6c69c658b20ca8d5e2df Mon Sep 17 00:00:00 2001
From: Remi Collet
Date: Sun, 27 May 2012 10:36:40 +0200
Subject: php-channel-phpdoc: import from rawhide
---
httpd-2.4.2-r1337344+.patch | 312 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 312 insertions(+)
create mode 100644 httpd-2.4.2-r1337344+.patch
(limited to 'httpd-2.4.2-r1337344+.patch')
diff --git a/httpd-2.4.2-r1337344+.patch b/httpd-2.4.2-r1337344+.patch
new file mode 100644
index 0000000..d569dbf
--- /dev/null
+++ b/httpd-2.4.2-r1337344+.patch
@@ -0,0 +1,312 @@
+
+suexec enhancements:
+
+1) use syslog for logging
+2) use capabilities not setuid/setgid root binary
+
+http://svn.apache.org/viewvc?view=revision&revision=1337344
+http://svn.apache.org/viewvc?view=revision&revision=1341905
+http://svn.apache.org/viewvc?view=revision&revision=1342065
+http://svn.apache.org/viewvc?view=revision&revision=1341930
+
+--- httpd-2.4.2/configure.in.r1337344+
++++ httpd-2.4.2/configure.in
+@@ -700,7 +700,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
+
+ AC_ARG_WITH(suexec-logfile,
+ APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
+- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
++ if test "x$withval" = "xyes"; then
++ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
++ fi
++])
++
++AC_ARG_WITH(suexec-syslog,
++APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
++ if test $withval = "yes"; then
++ if test "x${with_suexec_logfile}" != "xno"; then
++ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
++ AC_MSG_ERROR([suexec does not support both logging to file and syslog])
++ fi
++ AC_CHECK_FUNCS([vsyslog], [], [
++ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
++ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
++ fi
++])
++
+
+ AC_ARG_WITH(suexec-safepath,
+ APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
+@@ -710,6 +727,15 @@ AC_ARG_WITH(suexec-umask,
+ APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[
+ AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] )
+
++INSTALL_SUEXEC=setuid
++AC_ARG_ENABLE([suexec-capabilities],
++APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [
++INSTALL_SUEXEC=caps
++AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1,
++ [Enable if suexec is installed with Linux capabilities, not setuid])
++])
++APACHE_SUBST(INSTALL_SUEXEC)
++
+ dnl APR should go after the other libs, so the right symbols can be picked up
+ if test x${apu_found} != xobsolete; then
+ AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
+--- httpd-2.4.2/docs/manual/suexec.html.en.r1337344+
++++ httpd-2.4.2/docs/manual/suexec.html.en
+@@ -369,6 +369,21 @@
+ together with the --enable-suexec
option to let
+ APACI accept your request for using the suEXEC feature.
+
++ --enable-suexec-capabilities
++
++ Linux specific: Normally,
++ the suexec
binary is installed "setuid/setgid
++ root", which allows it to run with the full privileges of the
++ root user. If this option is used, the suexec
++ binary will instead be installed with only the setuid/setgid
++ "capability" bits set, which is the subset of full root
++ priviliges required for suexec operation. Note that
++ the suexec
binary may not be able to write to a log
++ file in this mode; it is recommended that the
++ --with-suexec-syslog --without-suexec-logfile
++ options are used in conjunction with this mode, so that syslog
++ logging is used instead.
++
+ --with-suexec-bin=PATH
+
+ The path to the suexec
binary must be hard-coded
+@@ -430,6 +445,12 @@
+ "suexec_log
" and located in your standard logfile
+ directory (--logfiledir
).
+
++ --with-suexec-syslog
++
++ If defined, suexec will log notices and errors to syslog
++ instead of a logfile. This option must be combined
++ with --without-suexec-logfile
.
++
+ --with-suexec-safepath=PATH
+
+ Define a safe PATH environment to pass to CGI
+@@ -546,9 +567,12 @@
+
+ The suEXEC wrapper will write log information
+ to the file defined with the --with-suexec-logfile
+- option as indicated above. If you feel you have configured and
+- installed the wrapper properly, have a look at this log and the
+- error_log for the server to see where you may have gone astray.
++ option as indicated above, or to syslog if --with-suexec-syslog
++ is used. If you feel you have configured and
++ installed the wrapper properly, have a look at the log and the
++ error_log for the server to see where you may have gone astray.
++ The output of "suexec -V"
will show the options
++ used to compile suexec, if using a binary distribution.
+
+ ![top](./images/up.gif)
+
+@@ -615,4 +639,4 @@
+
+-