Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running Ubuntu server 10.10 with Apache2-mpm-prefork and apache2-mod-php5, I am using:

    User www-data
    Group www-data

in the configuration file, when executing ps -efH I get these lines:

    root      1497     1  0 09:43 ?        00:00:00   /usr/sbin/apache2 -k start
    root      1530  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start
    www-data  1531  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start
    www-data  1532  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start

Apparently, a child process is running as root but why?

This also happened when I compiled Apache myself, I can't find a reason, and I do not know yet if this root-child process is serving requests or not.

share|improve this question
1  
It might help to take a look at the open files of the specific process. You can do it via the proc interface: ls -l /proc/1530/fd/. Or you can analyze the process with: lsof -p 1530. Maybe this gives you some hints. –  ceving Sep 13 '11 at 8:35

2 Answers 2

any process that binds to a port under 1024 (privileged port) needs to be run as root to bind. So the main apache process binds to the port and opens log files and does a few other root only items.

Then it will spawn off the children to do all the work of handling requests.

share|improve this answer
    
that explains the process 1497, but doesn't explain 1530, which is one of the children. –  Joe H. Sep 13 '11 at 14:23
    
What does netstat -tlnp show for your http-port? It is propably attached to PID 1530. –  Nils Sep 13 '11 at 20:03
    
you have a module or something that spawned off another process that needed to be root. I've seen some oracle stuff do that. –  Mike Sep 13 '11 at 22:37

Thank you guys, it is almost clear now and I am sure my setup is safe:

netstat -tlnp|grep apache2:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1497/apache2

lsof -p 1497:

COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
apache2 1497 root  cwd    DIR                8,2     4096       2 /
apache2 1497 root  rtd    DIR                8,2     4096       2 /
apache2 1497 root  txt    REG                8,2  1437809 2755831 /usr/lib/apache2/mpm-prefork/apache2
apache2 1497 root  mem    REG                8,2    88384 1835068 /lib/libgcc_s.so.1
apache2 1497 root  mem    REG                8,2    10248 2755896 /usr/lib/apache2/modules/mod_vhost_alias.so
apache2 1497 root  mem    REG                8,2    22528 2755882 /usr/lib/apache2/modules/mod_status.so
apache2 1497 root  mem    REG                8,2    14336 2755847 /usr/lib/apache2/modules/mod_setenvif.so
apache2 1497 root  mem    REG                8,2    63488 2755865 /usr/lib/apache2/modules/mod_rewrite.so
apache2 1497 root  mem    REG                8,2    14344 2755892 /usr/lib/apache2/modules/mod_reqtimeout.so
apache2 1497 root  mem    REG                8,2  6069136 2757137 /usr/lib/apache2/modules/libphp5.so
apache2 1497 root  mem    REG                8,2    30728 2755875 /usr/lib/apache2/modules/mod_negotiation.so
apache2 1497 root  mem    REG                8,2    18432 2755836 /usr/lib/apache2/modules/mod_mime.so
apache2 1497 root  mem    REG                8,2    18432 2755880 /usr/lib/apache2/modules/mod_headers.so
apache2 1497 root  mem    REG                8,2    10240 2755862 /usr/lib/apache2/modules/mod_env.so
apache2 1497 root  mem    REG                8,2    10240 2755849 /usr/lib/apache2/modules/mod_dir.so
apache2 1497 root  mem    REG                8,2    26624 2755851 /usr/lib/apache2/modules/mod_cgi.so
apache2 1497 root  mem    REG                8,2    34824 2755885 /usr/lib/apache2/modules/mod_autoindex.so
apache2 1497 root  mem    REG                8,2    10248 2755843 /usr/lib/apache2/modules/mod_authz_user.so
apache2 1497 root  mem    REG                8,2    10248 2755841 /usr/lib/apache2/modules/mod_authz_host.so
apache2 1497 root  mem    REG                8,2    10248 2755838 /usr/lib/apache2/modules/mod_authz_groupfile.so
apache2 1497 root  mem    REG                8,2     6152 2755900 /usr/lib/apache2/modules/mod_authz_default.so
apache2 1497 root  mem    REG                8,2    10248 2755887 /usr/lib/apache2/modules/mod_authn_file.so
apache2 1497 root  mem    REG                8,2    10248 2755856 /usr/lib/apache2/modules/mod_auth_basic.so
apache2 1497 root  mem    REG                8,2    14336 2755855 /usr/lib/apache2/modules/mod_alias.so
....
apache2 1497 root  DEL    REG                0,4             8727 /dev/zero
apache2 1497 root    0r   CHR                1,3      0t0    4206 /dev/null
apache2 1497 root    1w   CHR                1,3      0t0    4206 /dev/null
apache2 1497 root    2w   REG                8,2     1578  524530 /var/log/apache2/error.log
apache2 1497 root    3u  IPv4               8506      0t0     TCP *:www (LISTEN)
apache2 1497 root    4r  FIFO                0,8      0t0    8645 pipe
apache2 1497 root    5w  FIFO                0,8      0t0    8645 pipe
apache2 1497 root    6w   REG                8,2 36033304  524628 /var/log/apache2/other_vhosts_access.log
apache2 1497 root    7w   REG                8,2  1791423  524338 /var/log/apache2/access.log
apache2 1497 root    9u  unix 0xffff880037a5b0c0      0t0    8723 socket

lsof -p 1531:

COMMAND   PID     USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
apache2 1531 www-data  cwd    DIR                8,2     4096       2 /
....
apache2 1531 www-data    3u  IPv4               8506      0t0     TCP *:www (LISTEN)

what matter is the line:

apache2 1531 www-data 3u IPv4 8506 0t0 TCP *:www (LISTEN)

however for lsof -p 1530:

apache2 1530 root  cwd    DIR                8,2     4096       2 /
apache2 1530 root  rtd    DIR                8,2     4096       2 /
apache2 1530 root  txt    REG                8,2  1437809 2755831 /usr/lib/apache2/mpm-prefork/apache2
....

there is no TCP listen line, so this root-child process is not accepting requests, and as @Mike said, there should be a module which needs this functionality but I was unable to know which one (I have tried to disable them one by one with no success).

Thanks again.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.