| Sasha Prikhodko 2005-08-05, 7:46 am |
| Dear mod_python developers,
i have a serious subject to discuss
concerning tuning Apache MPMs and managing Python VMs.
The question is:
how to controll security and user's rights for VMs and mod_python
enabled Apache processes?
The story started when i tried to mount a Python application server
attaching it to a part of content of my domain, to virtual host,
directory or smth else. Everything goes well, though i hunt a requirement:
Core VM of the server should appear _once_ in _one_ process.
The reason is that i'd like to use Apache as a platform to get good
performance
connecting different components inside _one_ process.
Of course, i can start an isolated socket enabled Core server that will
handle
signals, core processing etc. but it is a long way 
Another way is not to worry about platform multiplication
(like prefork MPM do)
and to extract to the outside _all common work_ using OS services,
but this is again a complex way. (Observe that if we want to get solution
that will run in a _simple_ enviroment as well, then this way is a bad way.)
A solution that i have so far
is to run Apache with 'worker' MPM and tune it to get _one_ httpd process.
However there are still several problems:
1) I am cutting off all non-Python stuff that would not like such king
of processing,
say original Apache file serving, php etc.
2) I can controll different VMs (by name) but i _cannot_ control httpd
processes
and i must hang up virtual hosts to one process.
3) The main problem: still i have no a mechanism to branch out a less
priviledges
httpd-based process to do custom execution of cgi-like scenarious on
behalf of
_different users_. I can use cgi-call, and suexec, but suspect that this
gives bad performance.
It would be greate to create long living httpd processes with custom
rights ? ;-)
Again i can start an isolated process with a Python VM, but... what
about to use here
Apache platform as well?
Thank you,
Sasha Prikhodko,
Moscow State University
http://www.bnr.ru/
http://gil.sourceforge.net/
|