diff --git a/SPECS/fastcgi-2.5.te b/SPECS/fastcgi-2.5.te new file mode 100644 index 0000000..c691308 --- /dev/null +++ b/SPECS/fastcgi-2.5.te @@ -0,0 +1,63 @@ +# This policy module provides support for mod_fcgid using the httpd system script domain. +# It provides "allow" rules that will overlap to varying degrees with selinux-policy +# packages for Fedora 5 onwards, and is a stepping stone to the merged policy included +# as updates for selinux-policy in Fedora 8, 9, and 10. +# +# Rules existing in selinux-policy 2.6.4 (F7) have been stripped from this policy +# +# Previous versions of this policy module used a separate domain, httpd_fastcgi_script_t, +# which is now an alias for httpd_sys_script_t. + +policy_module(fastcgi, 0.2.6) + +require { + type devpts_t; + type httpd_t; + type httpd_log_t; + type httpd_sys_content_t; + type httpd_sys_content_ra_t; + type httpd_sys_content_ro_t; + type httpd_sys_content_rw_t; + type httpd_sys_script_exec_t; + type httpd_sys_script_ra_t; + type httpd_sys_script_ro_t; + type httpd_sys_script_rw_t; + type httpd_sys_script_t; + type httpd_tmp_t; + type httpd_var_run_t; +}; + +# Type aliases for contexts used with older policy modules +typealias httpd_sys_content_t alias httpd_fastcgi_content_t; +typealias httpd_sys_content_ra_t alias httpd_fastcgi_content_ra_t; +typealias httpd_sys_content_ro_t alias httpd_fastcgi_content_ro_t; +typealias httpd_sys_content_rw_t alias httpd_fastcgi_content_rw_t; +typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t; +typealias httpd_sys_script_ra_t alias httpd_fastcgi_script_ra_t; +typealias httpd_sys_script_ro_t alias httpd_fastcgi_script_ro_t; +typealias httpd_sys_script_rw_t alias httpd_fastcgi_script_rw_t; +typealias httpd_sys_script_t alias httpd_fastcgi_script_t; +typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; + +# ========================================================== +# Re-use httpd_sys_script_t for mod_fcgid apps +# ========================================================== + +# Allow web applications to call getpw* functions +auth_use_nsswitch(httpd_sys_script_t) + +# Allow httpd to create and use files and sockets for communicating with mod_fcgid +# Rules to do this are already in selinux-policy apart from dir setattr +setattr_dirs_pattern(httpd_t,httpd_var_run_t,httpd_var_run_t) + +# Allow FastCGI applications to listen for FastCGI requests on their +# sockets and respond to them +allow httpd_sys_script_t httpd_t:unix_stream_socket { rw_stream_socket_perms }; + +# These are probably leaked file descriptors +dontaudit httpd_t devpts_t:chr_file ioctl; +dontaudit httpd_sys_script_t httpd_log_t:file ioctl; + +# PHP uploads a file to /tmp and then execs programs to action them +# Rules to do this are already in selinux-policy 2.6.4 (F7) apart from filetrans +files_tmp_filetrans(httpd_sys_script_t,httpd_sys_script_rw_t,{ dir file lnk_file sock_file fifo_file }) diff --git a/SPECS/fastcgi.fc b/SPECS/fastcgi.fc new file mode 100644 index 0000000..2006d97 --- /dev/null +++ b/SPECS/fastcgi.fc @@ -0,0 +1 @@ +/var/run/mod_fcgid(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) diff --git a/SPECS/fastcgi.te b/SPECS/fastcgi.te new file mode 100644 index 0000000..373d920 --- /dev/null +++ b/SPECS/fastcgi.te @@ -0,0 +1,71 @@ +# This policy module provides support for mod_fcgid using the httpd system script domain. +# It provides "allow" rules that will overlap to varying degrees with selinux-policy +# packages for Fedora 5 onwards, and is a stepping stone to the merged policy included +# as updates for selinux-policy in Fedora 8, 9, and 10. +# +# Rules existing in selinux-policy 2.3.7 (FC5) have been stripped from this policy +# +# Previous versions of this policy module used a separate domain, httpd_fastcgi_script_t, +# which is now an alias for httpd_sys_script_t. + +policy_module(fastcgi, 0.1.11) + +require { + type devpts_t; + type httpd_t; + type httpd_log_t; + type httpd_sys_content_t; + type httpd_sys_script_exec_t; + type httpd_sys_script_ra_t; + type httpd_sys_script_ro_t; + type httpd_sys_script_rw_t; + type httpd_sys_script_t; + type httpd_tmp_t; + type httpd_var_run_t; +}; + +# Type aliases for contexts used with older policy modules +typealias httpd_sys_content_t alias httpd_fastcgi_content_t; +typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t; +typealias httpd_sys_script_ra_t alias httpd_fastcgi_script_ra_t; +typealias httpd_sys_script_ro_t alias httpd_fastcgi_script_ro_t; +typealias httpd_sys_script_rw_t alias httpd_fastcgi_script_rw_t; +typealias httpd_sys_script_t alias httpd_fastcgi_script_t; +typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; + +# ========================================================== +# Re-use httpd_sys_script_t for mod_fcgid apps +# ========================================================== + +# Allow web applications to call getpw* functions +auth_use_nsswitch(httpd_sys_script_t) + +# Allow httpd to create and use files and sockets for communicating with mod_fcgid +# Rules to do this are already in selinux-policy apart from dir setattr +allow httpd_t httpd_var_run_t:dir setattr; + +# Allow FastCGI applications to listen for FastCGI requests on their +# sockets and respond to them +allow httpd_sys_script_t httpd_t:unix_stream_socket { rw_stream_socket_perms }; + +# These are probably leaked file descriptors +dontaudit httpd_t devpts_t:chr_file ioctl; +dontaudit httpd_sys_script_t httpd_log_t:file ioctl; + +# Search automount filesystem to use automatically mounted filesystems +fs_search_auto_mountpoints(httpd_sys_script_t) + +# PHP uploads a file to /tmp and then execs programs to action them +allow httpd_sys_script_t httpd_tmp_t:dir manage_dir_perms; +allow httpd_sys_script_t httpd_tmp_t:file manage_file_perms; +files_tmp_filetrans(httpd_sys_script_t,httpd_sys_script_rw_t,{ dir file lnk_file sock_file fifo_file }) + +# Support network home directories +tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` + fs_read_nfs_files(httpd_sys_script_t) + fs_read_nfs_symlinks(httpd_sys_script_t) +') +tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` + fs_read_cifs_files(httpd_sys_script_t) + fs_read_cifs_symlinks(httpd_sys_script_t) +') diff --git a/SPECS/fcgid.conf b/SPECS/fcgid.conf new file mode 100644 index 0000000..90f208e --- /dev/null +++ b/SPECS/fcgid.conf @@ -0,0 +1,14 @@ +# This is the Apache server configuration file for providing FastCGI support +# through mod_fcgid +# +# Documentation is available at +# http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html + +LoadModule fcgid_module modules/mod_fcgid.so + +# Use FastCGI to process .fcg .fcgi & .fpl scripts +AddHandler fcgid-script fcg fcgi fpl + +# Sane place to put sockets and shared memory file +FcgidIPCDir /var/run/mod_fcgid +FcgidProcessTableFile /var/run/mod_fcgid/fcgid_shm diff --git a/SPECS/fcgid24.conf b/SPECS/fcgid24.conf new file mode 100644 index 0000000..2e7d486 --- /dev/null +++ b/SPECS/fcgid24.conf @@ -0,0 +1,12 @@ +# This is the Apache server configuration file for providing FastCGI support +# through mod_fcgid +# +# Documentation is available at +# http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html + +# Use FastCGI to process .fcg .fcgi & .fpl scripts +AddHandler fcgid-script fcg fcgi fpl + +# Sane place to put sockets and shared memory file +FcgidIPCDir /run/mod_fcgid +FcgidProcessTableFile /run/mod_fcgid/fcgid_shm diff --git a/SPECS/mod_fcgid-2.1-README.RPM b/SPECS/mod_fcgid-2.1-README.RPM new file mode 100644 index 0000000..89165c5 --- /dev/null +++ b/SPECS/mod_fcgid-2.1-README.RPM @@ -0,0 +1,75 @@ +Using the mod_fcgid RPM Package +=============================== + +This mod_fcgid package includes a configuration file +/etc/httpd/conf.d/fcgid.conf that ensures that the module is loaded and +added as the handler for .fcg, .fcgi, and .fpl applications. + +Example: setting up moin with mod_fcgid +======================================= + +Setting up moin with mod_fcgid is very similar to setting it up as a regular +CGI application. + + * Create a directory for your wiki instance: + + DESTDIR=/var/www/mywiki + mkdir -p $DESTDIR/cgi-bin + + * Copy in the wiki template data and the application itself: + + cp -a /usr/share/moin/{data,underlay} $DESTDIR + cp -a /usr/share/moin/server/moin.fcg $DESTDIR/cgi-bin + cp -a /usr/share/moin/config/wikiconfig.py $DESTDIR/cgi-bin + + * Fix the directory ownership + + chown -R apache:apache $DESTDIR/{data,underlay} + + * Edit $DESTDIR/cgi-bin/wikiconfig.py to suit your needs + + * Create a httpd configuration file for the wiki, e.g. + /etc/httpd/conf.d/mywiki.conf + + # Wiki application data common to all wiki instances + Alias /moin_static185 "/usr/share/moin/htdocs/" + + Options Indexes FollowSymLinks + AllowOverride None + Order allow,deny + Allow from all + + ExpiresActive On + ExpiresDefault "access plus 1 year" + + + + # Wiki instance with mod_fcgid + + ScriptAlias /mywiki "/var/www/mywiki/cgi-bin/moin.fcg" + + Options Indexes FollowSymLinks ExecCGI + AllowOverride None + Order allow,deny + Allow from all + + + + * Restart the web server to load the new configuration: + + service httpd restart + +That should do it! + +Ruby on Rails with mod_fcgid +============================ + +One of the differences between mod_fastcgi and mod_fcgid is that the former +sets the SCRIPT_NAME environment variable whilst the latter does not, and it's +reported (http://bugzilla.redhat.com/476658) that Ruby on Rails expects this +environment variable to be present. A workaround for this is to add: + +ActionController::AbstractRequest.relative_url_root = "" + +to the Rails::Initializer.run segment of config/environment.rb + diff --git a/SPECS/mod_fcgid-2.1-README.SELinux b/SPECS/mod_fcgid-2.1-README.SELinux new file mode 100644 index 0000000..981cf59 --- /dev/null +++ b/SPECS/mod_fcgid-2.1-README.SELinux @@ -0,0 +1,63 @@ +Using mod_fcgid with SELinux in Fedora Core 5 / RHEL 5 onwards +============================================================== + +Versions of this package built for Fedora Core 5, 6, or 7 include an SELinux +policy module to support FastCGI applications. Later Fedora releases and Red +Hat Enterprise Linux 5.3 onwards include the policy in the main selinux-policy +package and do not require the separate module. + +The module source (fastcgi.{fc,te}) is included for reference as documentation +in the package. + +The module uses the same set of SELinux types for FastCGI applications as for +regular CGI scripts (or "system scripts" as they are known in SELinux), as +described in "man httpd_selinux". + + * httpd_sys_content_t + - Set files with httpd_sys_content_t for content that is available + from all FastCGI scripts and the daemon. + + * httpd_sys_script_exec_t + - Set FastCGI scripts with httpd_sys_script_exec_t to allow them to run + with access to all system script types. + + * httpd_sys_script_ro_t + - Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t + scripts to read but not write the data, and disallow other processes from + access. + + * httpd_sys_script_rw_t + - Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t + scripts to read/write the data, and disallow other processes from access. + + * httpd_sys_script_ra_t + - Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t + scripts to read/append to the file, and disallow other processes from + access. + +So for the moin wiki layout described in README.RPM of the main mod_fcgid +package, the contexts would be set as follows: + + cd /var/www/mywiki + chcon -t httpd_sys_content_t . + chcon -R -t httpd_sys_script_exec_t cgi-bin + chcon -R -t httpd_sys_script_rw_t data underlay + +It is necessary to turn on the httpd_enable_cgi boolean to run either regular +or FastCGI scripts: + + setsebool -P httpd_enable_cgi 1 + +The httpd_can_sendmail boolean is used to specify whether any of your +web applications can make outbound SMTP connections (e.g. moin sending +notifications). By default it is off, but can be enabled as follows: + + setsebool -P httpd_can_sendmail 1 + +Only enable this functionality if you actually need it, since it increases the +chances that any vulnerability in any of your web applications could be +exploited by a spammer. + +If you have any questions or issues regarding FastCGI and SELinux, please don't +hesitate to bring them up on fedora-selinux-list. + diff --git a/SPECS/mod_fcgid-2.3.4-fixconf-shellbang.patch b/SPECS/mod_fcgid-2.3.4-fixconf-shellbang.patch new file mode 100644 index 0000000..ea5fb50 --- /dev/null +++ b/SPECS/mod_fcgid-2.3.4-fixconf-shellbang.patch @@ -0,0 +1,8 @@ +--- mod_fcgid-2.3.4/build/fixconf.sed 2009-10-07 04:16:08.000000000 +0100 ++++ mod_fcgid-2.3.4/build/fixconf.sed 2009-10-12 09:50:14.570448865 +0100 +@@ -1,4 +1,4 @@ +-#!/usr/bin/sed -f ++#!/bin/sed -f + # + # Licensed to the Apache Software Foundation (ASF) under one or more + # contributor license agreements. See the NOTICE file distributed with diff --git a/SPECS/mod_fcgid-2.3.9.tar.bz2 b/SPECS/mod_fcgid-2.3.9.tar.bz2 new file mode 100644 index 0000000..5eeead8 Binary files /dev/null and b/SPECS/mod_fcgid-2.3.9.tar.bz2 differ diff --git a/SPECS/mod_fcgid-tmpfs.conf b/SPECS/mod_fcgid-tmpfs.conf new file mode 100644 index 0000000..d7103ba --- /dev/null +++ b/SPECS/mod_fcgid-tmpfs.conf @@ -0,0 +1 @@ +d /run/mod_fcgid 0775 root apache