Closed andreblanke closed 1 year ago
Thanks for the detailed report. Looking at this, I believe md_util_exec
should use APR_PROGRAM_ENV
and remove its env
parameter since any value given there will not have an effect then, as you observed.
In the case of #198, we tried to supply additional vars to the called process, but that resulted in the inherited environment of httpd to be completely replaced. Which did lead to the failures reported there.
Note that #198 was on Windows, where APR_PROGRAM
and APR_PROGRAM_ENV
have the same implementation. So it did not matter there.
As to your original intention of reloading Apache in such a program, that will not work in default Linux setups where root
is needed for reloads, but the invoked program will run as an unprivileged user like www-data
.
Could you give #320 a try?
Note that https://github.com/icing/mod_md/issues/198 was on Windows, where
APR_PROGRAM
andAPR_PROGRAM_ENV
have the same implementation. So it did not matter there.
Ah, so that was confusing me.
As to your original intention of reloading Apache in such a program, that will not work in default Linux setups where root is needed for reloads, but the invoked program will run as an unprivileged user like www-data.
Thanks for the heads-up. My original plan was to give www-data
permission to execute only /usr/local/apache2/apachectl -k graceful
with elevated rights, but using ports other than 80 and 443 might be the more secure approach for my use case.
Could you give https://github.com/icing/mod_md/pull/320 a try?
The PR fixes the issue for me. Thank you for your quick help.
Thanks for testing.
Using httpd v2.4.57 and mod_md v2.4.21 on Linux 6.4.10, I've been trying to gracefully reload httpd from a simple script executed by
MDNotifyCmd
orMDMessageCmd
:However, it appears that environment variables are not correctly inherited by the child process, resulting in warnings akin to
because my
httpd.conf
relies on certain environment variables being set. If I extend the above script to include an invocation ofprintenv
, onlyPWD=/usr/local/apache2
is printed as environment variable which seems to confirm my assumption.Issue https://github.com/icing/mod_md/issues/198 looks related, but it is resolved and inheritance appears to work correctly in that case.
Reproducible example
I have written a small example program which – at least on my machine – demonstrates the issue. It uses the Apache Portable Runtime and
md_util_exec
along with stubs copied from mod_md.md_util_exec
is used to invoke/usr/bin/printenv
twice, passingENV_VAR=value
as environment variable first andNULL
second. The following output is produced by the program:As you can see, neither of the process executions inherit the environment variables of the parent process. By changing the cmdtype passed to
apr_procattr_cmdtype_set
fromAPR_PROGRAM
toAPR_PROGRAM_ENV
, both processes seem to inherit the environment of the parent, but the additionalENV_VAR=value
set in the first configuration is not set for the child process and thus lost.Source code
```c #includeClosing words
I don't really understand why the functionality looks to be working in https://github.com/icing/mod_md/issues/198, but it sadly isn't in my case unless I am missing something.
As a fix, it could be possible to implement a function to retrieve all environment variables for POSIX and WIN32, include ones relevant for mod_md, and then pass the new list of variables to
md_util_exec
. The function could be extracted to APR at a later time.