mod_privsep patches for Apache httpd
Please note that mod_privsep is still experimental.
httpd-2.3.0-dev (trunk) patches:
mod_privsep-2.3.0-0.2.2.patch - The module proper, implements the privsep privileged operation process that listens on a unix socket for privileged operations and performs them on behalf of the unprivileged apache worker processes
(Note: This version of the patch relies on 2 new functions, apr_os_file_put_ex and apr_os_dir_put_ex for which patches are in the apr bugzilla links mentioned in the Notes section below).
mod_authn_privsep-2.3.0-0.2.patch - The privilege separated authentication module.
privsep_core_changes-2.3.0-0.2.patch - Changes to Apache core, request and mod_autoindex to use the privilege separated file io functions. Adds hook functions for privileged wrapper functions so the module can be optionally compiled in or out.
privsep_mod_dav_changes-2.3.0-0.2.patch - Changes to mod_dav to use the privilege separated file io functions.
httpd-2.2.6 patches:
You can use the first two 2.3.0-dev patches above (mod_privsep-2.3.0-...patch and mod_authn_privsep-2.3.0-...patch) patches plus these 2.2.6 specific core patches:
privsep_core_changes-2.3.0-0.2.patch - Changes to Apache core, request and mod_autoindex to use the privilege separated file io functions. Adds hook functions for privileged wrapper functions so the module can be optionally compiled in or out.
privsep_mod_dav_changes-2.3.0-0.2.patch - Changes to mod_dav to use the privilege separated file io functions.
Notes:
The version of the patch for 2.2.6 requires access to some private headers due to limitations in the APR api.
There are two proposed patches against apr trunk which allow mod_privsep in 2.3.0-dev to work without access to private APR headers:
If you have apr already installed and the configure script is picking up your system apr library and includes (which don't have the private headers as they are not usually installed) then you may need to force the build against the bundled apr (in httpd-2.2.6/srclib/apr) so the private headers can be accessed.
You can override the system apr and force configure to use the bundled apr by adding --with-apr=srclib/apr --with-apr-util=srclib/apr-util to the configure script arguments.
httpd-2.0.x patches:
- There is currently no patches available for apache 2.0.x
httpd-1.3.41 patches:
README - Instructions building and using the httpd-1.3.41 versions of the patches
privsep-apache-1.3.41-0.6.patch - Changes for Apache 1.3.41
privsep-mod_dav-1.0.3-1.3.6-0.6.patch - Changes for mod_dav 1.0.3
build-apache-privsep.sh - Script to apply patches and build Apache with mod_dav and mod_ssl
httpd-1.3.39 patches:
README - Instructions building and using the httpd-1.3.39 versions of the patches
privsep-apache-1.3.39-0.5.patch - Changes for Apache 1.3.39
privsep-mod_dav-1.0.3-1.3.6-0.5.patch - Changes for mod_dav 1.0.3
build-apache-privsep.sh - Script to apply patches and build Apache with mod_dav and mod_ssl