SSLproxy

Commit Graph

Author	SHA1	Message	Date
Daniel Roethlisberger	476967ccdc	Add SIGUSR1 to the signals forwarded by the parent	10 years ago
Daniel Roethlisberger	0e0a465f5d	Fix build on OpenBSD by adding missing includes	10 years ago
Daniel Roethlisberger	c01ace1261	Introduce privilege separation architecture Fork into a monitor parent process and an actual proxy child process, communicating over AF_UNIX sockets. Certain privileged operations are performed through the privileged parent process, like opening log files or listener sockets, while all other operations happen in the child process, which can now drop its privileges without side-effects for log file opening and other privileged operations. This is also a preparation for -l/-L logfile reopening through SIGUSR1. This means that -S and -F are no longer relative to chroot() if used with -j. This is a deliberate POLA violation.	10 years ago

Author

SHA1

Message

Date

Daniel Roethlisberger

476967ccdc

Add SIGUSR1 to the signals forwarded by the parent

Daniel Roethlisberger

0e0a465f5d

Fix build on OpenBSD by adding missing includes

Daniel Roethlisberger

c01ace1261

Introduce privilege separation architecture

Fork into a monitor parent process and an actual proxy child process,
communicating over AF_UNIX sockets.  Certain privileged operations are
performed through the privileged parent process, like opening log files
or listener sockets, while all other operations happen in the child
process, which can now drop its privileges without side-effects for
log file opening and other privileged operations.  This is also a
preparation for -l/-L logfile reopening through SIGUSR1.

This means that -S and -F are no longer relative to chroot() if used
with -j.  This is a deliberate POLA violation.

3 Commits (476967ccdc40fa02c3e6b18edb064cfa19b334cc)