From 64aa8201b51d98aaf6037986308b32ddf33b1926 Mon Sep 17 00:00:00 2001 From: robs Date: Sun, 22 Sep 2002 19:00:51 +0000 Subject: [PATCH] tweak FastCgiWrapper discussion --- docs/mod_fastcgi.html | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/docs/mod_fastcgi.html b/docs/mod_fastcgi.html index 206876d..ddacc65 100644 --- a/docs/mod_fastcgi.html +++ b/docs/mod_fastcgi.html @@ -1,6 +1,6 @@ - + Apache module mod_fastcgi @@ -925,16 +925,26 @@ </P> <P> When <CODE>FastCgiWrapper</CODE> is enabled, the location of static or external FastCGI application - directives can be important. They inherit their user and group from the <CODE>User</CODE> and - <CODE>Group</CODE> of the virtual server in which they were defined. <CODE>User</CODE> and - <CODE>Group</CODE> directives should precede FastCGI application definitions. Note that this does - <EM>not</EM> limit the FastCGI application to the virtual server in which they were defined, the - application is allowed to service requests from any virtual server with the same user and group. If a - request is received for a FastCGI application without an existing matching definition running with the - correct user and group, a dynamic instance of the application is started with the correct user and group. - This can lead to multiple copies of the same application running with different user/group. If this is a - problem, preclude navigation to the application from other virtual servers or configure the virtual servers - with the same User and Group. + directives can be important. Under Apache 1.3, they inherit their user and group from the <CODE>user and + group</CODE> of the virtual server in which they are defined. <CODE><A HREF= + "http://httpd.apache.org/docs/mod/core.html#user">User</A></CODE> and <CODE><A HREF= + "http://httpd.apache.org/docs/mod/core.html#group">Group</A></CODE> directives <I><U>must</U></I> precede + FastCGI application definitions. Under Apache 2.0, the <CODE>-user</CODE> and <CODE>-group</CODE> options + to <A HREF="#FastCgiServer">FastCgiServer</A> and <A HREF= + "#FastCgiExternalServer">FastCgiExternalServer</A> directives must be used (dynamic applications still use + the virtual server's user and group). + </P> + <P> + Note that access to (use of) FastCGI applications is <U><I>not</I></U> limited to the virtual server in + which they were defined. The application is used to service requests from any virtual server with the same + user and group. + </P> + <P> + If a request is received for a FastCGI application without an existing matching definition already running + with the correct user and group, a dynamic instance of the application is started with the correct user and + group. This can lead to multiple copies of the same application running with different user/group. If this + is a problem, preclude navigation to the application from other virtual servers or configure the virtual + servers with the same User and Group. </P> <P> See the Apache documentation for more information about suexec (make sure you fully understand the security -- 2.11.4.GIT