Re: [APC-DEV] Spurious writes to /tmp

Hello Jay, The /tmp/.apc.XXXXXX files are created because you're using file locking (the default): apc_fcntl.c:

    40         char lock_path[] = "/tmp/.apc.XXXXXX";

If it's of use to you we could probably make this more path more configurable, but as a solution to get you up and running fixing /tmp permissions is one way. You can also try out the IPC Semaphore, pthread, or spin locks out as well (pthread and spin locks being the fastest choices). Sorry you had difficulties in getting to this list, the news server seems to be back up now: http://news.php.net/php.apc.dev. -shire On May 6, 2007, at 8:19 AM, Jay L. T. Cornwall wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I'm in the process of setting up a CentOS 5 installation, which ships with a tightened SELinux policy. APC is installed and working well, however I notice that on any access to a PHP script - or, confusingly, any CGI script also - these warnings are generated: avc: denied { read, write } for comm="test.sh" dev=dm-0 egid=48 euid=48 exe="/bin/bash" exit=0 fsgid=48 fsuid=48 gid=48 items=0 name=".apc.ZEAkwD" Elaborated by sealert:

Source Context                user_u:system_r:httpd_sys_script_t
Target Context                user_u:object_r:httpd_tmp_t
Target Objects                /tmp/.apc.Yv21vf (deleted) [ file ]

The "error" occurs because SELinux is configured to disallow CGI scripts write access to /tmp, which is fine - I can fix that if it's desirable later. Two questions: 1) Why are these files created? My apc.ini specifies this:

    apc.mmap_file_mask=/var/cache/apc/apc.XXXXXX

I assume mkstemp() is directing something towards /tmp but I'm not sure why. If there's a need to generate temporary files then that's fine, but it would be really nice to have an option to redirect them elsewhere. Giving CGI scripts access to /tmp makes a lot of generic exploits that bit more likely to succeed. 2) Why is APC being invoked for CGI scripts that don't use PHP? Many thanks if you can shed some light on this. APC's a neat little bit of software and if I can get this resolved, it'll play ball with CentOS 5 (and by extension RHEL 5)! (Apologies if you receive this twice. Finding and getting onto this list was really difficult - the mailing list archive site is down, the news server hasn't/isn't going to forward my post and someone's created this highly hidden apc-dev list instead of the PECL one!) - -- Jay L. T. Cornwall, http://www.esuna.co.uk/~jay/ PhD Student Imperial College London -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGPfH9oHnC75cy2zgRAlEMAJ9VcOe9nhfdjh8zBEHQFq5JA3iArgCdHwxE A3+1Ejg1hKMWPOujAxzhV2w= =A0kD -----END PGP SIGNATURE----- --APC Development Mailing List (http://pecl.php.net/APC) To unsubscribe, visit: http://www.php.net/unsub.php

- Shire

    shire@facebook.com
    shire@php.net