From owner-freebsd-security@FreeBSD.ORG  Sat Dec  4 11:13:44 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 801D416A4CE
	for <freebsd-security@freebsd.org>;
	Sat,  4 Dec 2004 11:13:44 +0000 (GMT)
Received: from goofy.cultdeadsheep.org (charon.cultdeadsheep.org
	[80.65.226.72])	by mx1.FreeBSD.org (Postfix) with SMTP id 2745E43D5A
	for <freebsd-security@freebsd.org>;
	Sat,  4 Dec 2004 11:13:42 +0000 (GMT)
	(envelope-from sheep.killer@cultdeadsheep.org)
Received: (qmail 11274 invoked by uid 89); 4 Dec 2004 12:13:40 +0100
Received: from sheep.killer@cultdeadsheep.org by goofy.cultdeadsheep.org by
	uid 89 with qmail-scanner-1.22 
	(clamdscan: 0.74. spamassassin: 2.63.   Clear:RC:1(192.168.0.8):. 
	Processed in 0.03974 secs); 04 Dec 2004 11:13:40 -0000
X-Qmail-Scanner-Mail-From: sheep.killer@cultdeadsheep.org via
	goofy.cultdeadsheep.org
X-Qmail-Scanner: 1.22 (Clear:RC:1(192.168.0.8):. Processed in 0.03974 secs)
Received: from unknown (HELO persephone.cultdeadsheep.org) (192.168.0.8)
  by goofy.cultdeadsheep.org with SMTP; 4 Dec 2004 12:13:40 +0100
Received: (qmail 74712 invoked from network); 4 Dec 2004 12:12:51 +0100
Received: from unknown (HELO localhost) (192.168.0.4)
  by persephone.cultdeadsheep.org with SMTP; 4 Dec 2004 12:12:51 +0100
Date: Sat, 4 Dec 2004 12:14:05 +0100
From: Clement Laforet <sheep.killer@cultdeadsheep.org>
To: freebsd-security@freebsd.org
Message-Id: <20041204121405.5e73fc66.sheep.killer@cultdeadsheep.org>
In-Reply-To: <1164.213.112.198.152.1102141467.squirrel@mail.hackunite.net>
References: <1164.213.112.198.152.1102141467.squirrel@mail.hackunite.net>
Organization: tH3 cUlt 0f tH3 d3@d sH33p
X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i386-portbld-freebsd5.3)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Re: Is my Apache server running as the root user or not?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 04 Dec 2004 11:13:44 -0000

On Sat, 4 Dec 2004 07:24:27 +0100 (CET)
"Jesper Wallin" <jesper@hackunite.net> wrote:

> Heya..
> 
> By reading my /usr/local/etc/apache2/httpd.conf, I can find out that
> my Apache is running as the user "www" and the group "www" .. Yet,
> when I run sockstat, it tells me one of the forks are runned as root
> and listening on port 80 as well as the other forks are runned by
> www:www.. If I got a lot of users connecting to my server on port 80,
> will thier requests ever be answered by the root fork or the www:www
> forks?

Process owned by root is the parent process. It doesn't actually handled
connections, only sets up socket(s) at initialization stage. Children
processes (owned by your User/Group settings) accept new connections and
deal with the requests.
Since you need to be root be able to bind on port 80, parent process is
owned by root.

clem

--