Re: policy question

[Tom <tom@lemuria.org>]

On Thu, Apr 18, 2002 at 08:28:07PM +0200, Russell Coker wrote:
> > Of course. The real-life problem is that I would prefer to reach this
> > goal without major changes to apache or the environment. The regular
> > workings of apache don't allow for anything like this, if for no other
> > reason then the fact that the children "hang around" after they have
> > one request done to handle the next ones. Anything else and you drown
> > in fork() overhead.
> 
> That's easy to solve.  Such children hang around for a certain amount of time 
> and then exit if they aren't being used.  Just like the model Apache uses for 
> it's own processes.

I know all this. I've been a sysadmin for apache servers for a couple
of years.

The point is that the reuse of children makes the "fork and change UID"
approach impractical. It works for SSH, but not for apache.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/D88D35A6 2001-11-14 Tom Vogt <tom@lemuria.org>
     Key fingerprint = 276B B7BB E4D8 FCCE DB8F  F965 310B 811A D88D 35A6

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.