Hello,
As some may now, ModSecurity adds a very easy and effective way to put
Apache in jail, but chrooting the process after its initialisation, thus
putting all listening processes in jail.
You specify one directive, and the only thing you have to put in the
jail is your htdocs and logs directories; all other files (conf,
modules, httpd, libraries, etc.) are outside of the jail. This is really
top security - it's almost impossible to find something to hack.
Unfortunately, the only thing that does not work is a graceful restart,
as the process has no more access to all normal files.
Couldn't it be possible to separate the main process in 2 - one real
master performing the start/stop/restart, and one "almost main" chrooted
process which would spawn the listening children processes ?
The chrooted process could be implemented in the core, or it could be
left to ModSecurity.
That would be the top security, much more secure than any solution based
on IIS for instance.
Do you think this could be envisioned ?
Thanks,
Nick
