SECUIRTY ISSUES
---------------

  1.	Apache 1.3.12 must be compiled with -DBIG_SECURITY_HOLE in order for
	this module to work.

  2.	"User root" directive must be set so that the child processes using
	this module can perform a setuid() and setgid(). If the User
	directive is set to someone else then this module is disabled.

  3.	The server runs slower if using -DSET_PROCESS_OWNER=REAL_OWNER,
  	because each process handles only one request and then is
	considered tainted and killed.

  4.	Nothing is done about open file descriptors and therefore they could
	be subverted in some manner, such as to corrupt web server logs.

  5.	Idle child processes of the server sit around as User root.

  6.	Apache processes handlers in reverse order from which they were
	loaded. Its highly recommended that mod_become be the last module in
	the LoadModule sequence, because in this way mod_become's handler
	will be the first executed within its applied phase, so no other
	module can skip mod_become.

  7.	mod_become is applied in phase 4, host access control, because this
	phase loosely corresponds with mod_become's purpose, application of
	user/group file access control.

	mod_become could be applied in phase 3, header parsing, since all
	possible URI translations of phase 2 would be done, but was
	discounted purely on the grounds that phase 4 appeared more
	appropriate.

	Applying mod_become somewhere between phases 5 and 9 did not seem
	appropriate, because starting with phase 5, user authentication,
	file accesses to databases, etc. would be more likely to occur
	depending on other modules installed. Essentially the longer
	mod_become waits to set the process ownership, means the more likely
	another module can introduce a security problem by performing file
	reads and possible writes as user root, which could introduce
	security problems; consider the	possibility of future buffer-overflow
	exploits in other modules.

	And phase 10, logging, is so far out there that you may as well
	run screaming into the night.

  8.	Changing user & group ids part way through the request cycle
	might be too much of a shock to the server and may introduce bugs
	related to file access & security.

  9.	Use of NFS mounted partitions as the home for web pages may cause
	mod_become problems in some cases. The problems may arise if user
	root is only given the permissions of 'nobody' for the files that
	are NFS mounted. If you do let the root userid on your web server
	write into shared NFS files, you may someday find that all of the
	lovely disk has been trashed by some malevolent entity on the net
	as a warning to others.

 10.	Just because you configure 'Become user root' does not mean it will
	work unless you also configure 'BecomeRoot ok' for the same
	virtualhost, directory or location.

 11.	Have you considered the relative merits of just giving everyone
	that wants to serve web pages on your machine root access? There
	is no guarentee that using this module will not have the same
	impact.


