Re: Security implication of using force-reload instead of restart ?

2011-01-09 Thread Paul Wise
The same problem occurs with all libraries and is really the responsibility of the sysadmin to deal with. Install debian-goodies and run checkrestart after every relevant upgrade. For desktop users the upgrade software can help, for example PackageKit:

Re: Security implication of using force-reload instead of restart ?

2011-01-09 Thread Stefan Fritsch
On Sunday 09 January 2011, Nikita V. Youshchenko wrote: I've just noticed that on libapache2-mod-php5 package upgrade, apache server was not restartted (but only HUPed because of force-reload called from libapache2-mod-php5 postinst) Doesn't this mean that running apache has still old

Re: Security implication of using force-reload instead of restart ?

2011-01-09 Thread Olaf van der Spek
On Sun, Jan 9, 2011 at 10:14 AM, Stefan Fritsch s...@sfritsch.de wrote: No. Apache unloads and reloads modules on a graceful restart, unless a modules takes special measures to prevent that. You can check that with lsof or checkrestart. But libapache2-mod-php5's behaviour is not optimal for

Re: Security implication of using force-reload instead of restart ?

2011-01-09 Thread Stefan Fritsch
On Sunday 09 January 2011, Olaf van der Spek wrote: On Sun, Jan 9, 2011 at 10:14 AM, Stefan Fritsch s...@sfritsch.de wrote: No. Apache unloads and reloads modules on a graceful restart, unless a modules takes special measures to prevent that. You can check that with lsof or checkrestart.

Re: Security implication of using force-reload instead of restart ?

2011-01-09 Thread Olaf van der Spek
On Sun, Jan 9, 2011 at 5:31 PM, Stefan Fritsch s...@sfritsch.de wrote: Shouldn't libapache2-mod-php5 be deprecated in favor of PHP via FastCGI anyway? Would avoid this and other issues. mod_php won't go away quickly. Why not? But having an out-of-the box usable php+fastcgi configuration in

Security implication of using force-reload instead of restart ?

2011-01-08 Thread Nikita V. Youshchenko
Hi I've just noticed that on libapache2-mod-php5 package upgrade, apache server was not restartted (but only HUPed because of force-reload called from libapache2-mod-php5 postinst) Doesn't this mean that running apache has still old version of php module loaded, so it still is vulnerable to