3

I am running Ubuntu server 10.10 with Apache2-mpm-prefork and apache2-mod-php5, I am using:

    User www-data
    Group www-data

in the configuration file, when executing ps -efH I get these lines:

    root      1497     1  0 09:43 ?        00:00:00   /usr/sbin/apache2 -k start
    root      1530  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start
    www-data  1531  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start
    www-data  1532  1497  0 09:43 ?        00:00:00     /usr/sbin/apache2 -k start

Apparently, a child process is running as root but why?

This also happened when I compiled Apache myself, I can't find a reason, and I do not know yet if this root-child process is serving requests or not.

dimsh
  • 31
  • 1
  • 4
  • 1
    It might help to take a look at the open files of the specific process. You can do it via the proc interface: `ls -l /proc/1530/fd/`. Or you can analyze the process with: `lsof -p 1530`. Maybe this gives you some hints. – ceving Sep 13 '11 at 08:35

2 Answers2

4

any process that binds to a port under 1024 (privileged port) needs to be run as root to bind. So the main apache process binds to the port and opens log files and does a few other root only items.

Then it will spawn off the children to do all the work of handling requests.

Mike
  • 21,910
  • 7
  • 55
  • 79
  • that explains the process 1497, but doesn't explain 1530, which is one of the children. – Joe H. Sep 13 '11 at 14:23
  • What does `netstat -tlnp` show for your http-port? It is propably attached to PID 1530. – Nils Sep 13 '11 at 20:03
  • you have a module or something that spawned off another process that needed to be root. I've seen some oracle stuff do that. – Mike Sep 13 '11 at 22:37
0

Thank you guys, it is almost clear now and I am sure my setup is safe:

netstat -tlnp|grep apache2:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1497/apache2

lsof -p 1497:

COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
apache2 1497 root  cwd    DIR                8,2     4096       2 /
apache2 1497 root  rtd    DIR                8,2     4096       2 /
apache2 1497 root  txt    REG                8,2  1437809 2755831 /usr/lib/apache2/mpm-prefork/apache2
apache2 1497 root  mem    REG                8,2    88384 1835068 /lib/libgcc_s.so.1
apache2 1497 root  mem    REG                8,2    10248 2755896 /usr/lib/apache2/modules/mod_vhost_alias.so
apache2 1497 root  mem    REG                8,2    22528 2755882 /usr/lib/apache2/modules/mod_status.so
apache2 1497 root  mem    REG                8,2    14336 2755847 /usr/lib/apache2/modules/mod_setenvif.so
apache2 1497 root  mem    REG                8,2    63488 2755865 /usr/lib/apache2/modules/mod_rewrite.so
apache2 1497 root  mem    REG                8,2    14344 2755892 /usr/lib/apache2/modules/mod_reqtimeout.so
apache2 1497 root  mem    REG                8,2  6069136 2757137 /usr/lib/apache2/modules/libphp5.so
apache2 1497 root  mem    REG                8,2    30728 2755875 /usr/lib/apache2/modules/mod_negotiation.so
apache2 1497 root  mem    REG                8,2    18432 2755836 /usr/lib/apache2/modules/mod_mime.so
apache2 1497 root  mem    REG                8,2    18432 2755880 /usr/lib/apache2/modules/mod_headers.so
apache2 1497 root  mem    REG                8,2    10240 2755862 /usr/lib/apache2/modules/mod_env.so
apache2 1497 root  mem    REG                8,2    10240 2755849 /usr/lib/apache2/modules/mod_dir.so
apache2 1497 root  mem    REG                8,2    26624 2755851 /usr/lib/apache2/modules/mod_cgi.so
apache2 1497 root  mem    REG                8,2    34824 2755885 /usr/lib/apache2/modules/mod_autoindex.so
apache2 1497 root  mem    REG                8,2    10248 2755843 /usr/lib/apache2/modules/mod_authz_user.so
apache2 1497 root  mem    REG                8,2    10248 2755841 /usr/lib/apache2/modules/mod_authz_host.so
apache2 1497 root  mem    REG                8,2    10248 2755838 /usr/lib/apache2/modules/mod_authz_groupfile.so
apache2 1497 root  mem    REG                8,2     6152 2755900 /usr/lib/apache2/modules/mod_authz_default.so
apache2 1497 root  mem    REG                8,2    10248 2755887 /usr/lib/apache2/modules/mod_authn_file.so
apache2 1497 root  mem    REG                8,2    10248 2755856 /usr/lib/apache2/modules/mod_auth_basic.so
apache2 1497 root  mem    REG                8,2    14336 2755855 /usr/lib/apache2/modules/mod_alias.so
....
apache2 1497 root  DEL    REG                0,4             8727 /dev/zero
apache2 1497 root    0r   CHR                1,3      0t0    4206 /dev/null
apache2 1497 root    1w   CHR                1,3      0t0    4206 /dev/null
apache2 1497 root    2w   REG                8,2     1578  524530 /var/log/apache2/error.log
apache2 1497 root    3u  IPv4               8506      0t0     TCP *:www (LISTEN)
apache2 1497 root    4r  FIFO                0,8      0t0    8645 pipe
apache2 1497 root    5w  FIFO                0,8      0t0    8645 pipe
apache2 1497 root    6w   REG                8,2 36033304  524628 /var/log/apache2/other_vhosts_access.log
apache2 1497 root    7w   REG                8,2  1791423  524338 /var/log/apache2/access.log
apache2 1497 root    9u  unix 0xffff880037a5b0c0      0t0    8723 socket

lsof -p 1531:

COMMAND   PID     USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
apache2 1531 www-data  cwd    DIR                8,2     4096       2 /
....
apache2 1531 www-data    3u  IPv4               8506      0t0     TCP *:www (LISTEN)

what matter is the line:

apache2 1531 www-data 3u IPv4 8506 0t0 TCP *:www (LISTEN)

however for lsof -p 1530:

apache2 1530 root  cwd    DIR                8,2     4096       2 /
apache2 1530 root  rtd    DIR                8,2     4096       2 /
apache2 1530 root  txt    REG                8,2  1437809 2755831 /usr/lib/apache2/mpm-prefork/apache2
....

there is no TCP listen line, so this root-child process is not accepting requests, and as @Mike said, there should be a module which needs this functionality but I was unable to know which one (I have tried to disable them one by one with no success).

Thanks again.

dimsh
  • 31
  • 1
  • 4