Do not require root privileges

Description

This patch removes the necessity and ability to run quark as root. quark will neither chroot(2) into the serving directory nor change the UID, GID or ownership of the UNIX-domain socket file. It will only serve files under its current working directory; absolute paths and ".." are normalized into relative ones to the current working directory or vhost ones.

Process related functions, like 'setpgrp(2)' and 'setrlimit(2)', are also removed because your system already has better tools to manage process credentials and capabilities. For example, to bind quark on tcp port 80, you can set ambient capability CAP_NET_BIND_SERVICE from root, cd into www-root, setuid into unpriviliged user and exec into quark.

quark already normalizes URL paths for ".." directories, thus internal path that is passed to filesystem-operating functions can safely be constructed with "./" or vhost prefix.

The only way to leave the working directory is through symbolic links, but quark doesn't create any new files, so it's safe. Besides, symbolic links are usefull for pointing to the files outside of www-root without a need to bind-mount other directories, hardlinks or copy all the files. chroot(2) limits you from doing all that, besides creating more problems from changing process root directory.

This patch has not been tested with a UNIX-domain socket file.

Download

Author