How to chroot VirtualHosts on a Apache server?

Question

I have a FreeBSD server (company's OS of choice). Currently we run several websites on each of the webservers. Websites are in PHP which is run in Apache Module mode. At the Apache is not chrooted so Apache and PHP have access to the whole filesystem.

For my private websites I use a shared hosting service. It seems that the service provider is running a customised Apache version. What is interesting, each website (VirtualHost I presume) on the server is chrooted the to DocumentRoot. How would I go about doing this on my Apache setup?

I have looked at Apache's ChrootDir which is almost good enough for me, but there is either a problem with it handling VirtualHosts or me not being able to set it up properly. Although it seems to run fine - can access VirtualHosts - there seems to be a problem when (re)starting the apache. I get warnings for VirtualHosts DocumentRoot. The config extract:

ChrootDir "/usr/local/www/apache22/data"
DocumentRoot "/"

<VirtualHost *:80>
    DocumentRoot "/test-1"
    ServerName test-1.example.com
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot "/test-2"
    ServerName test-1.example.com
</VirtualHost>

And the warnings are:

Warning: DocumentRoot [/test-1] does not exist
Warning: DocumentRoot [/test-2] does not exist

Also, there are a lot more problems with SSL enabled. Haven't got round to resolving those yet though.

So, my questions are:

1. How to chroot each VirtualHost to its DocumentRoot?
2. How to properly chroot Apache's global DocumentRoot to make it work with VirtualHosts and SSL?

Answer 1

It's a bug so to say. The problem is that Apache is checking your configuration file before actually starting, makes perfect sense for a number of reasons. But this means the check is run before the chroot syscall gets issued, so the directory is not found. It's safe to ignore the message, but there's no way to get rid of them short of editing Apache's code.