We have used Apache MPM-ITK for privilege separation for several years now. It works well for our needs, but recently we tried to host a PHP application that needs to define a
RewriteLock for mod_rewrite's
RewriteMap "prg" method. If is not working correctly due to permissions denying access to the lock file.
- Our virtual hosts are all running under different UID/GID's.
- Only one
RewriteLockmay be defined server-wide.
- It makes sense that if the
RewriteLockis defined with a particular owner/group, that a process running under a different user/group (the Apache vhost) will not be able to obtain the lock.
RewriteLockis definitely needed, as the server load is causing overlapped requests funneling through the
(13)Permission denied: mod_rewrite: could not init rewrite_mapr_lock_acquire in child
RewriteMap never gets called if the
RewriteLock directive is used.
What I have tried:
- Setting the lock file directory and file itself to have full permissions. RESULT: Lock permission denied.
- Setting the virtual host to run as root:root. RESULT: Lock file successfully locked. Note: This attempt is not an option due to the security risk, but at least I know it can work.
Is there a way I can define a lock file for use under MPM-ITK (RewriteLock) so all user:group Apache users can attain and release the lock?