From ea1a4360d66a833d75fbd887388d8cd4fe4ae299 Mon Sep 17 00:00:00 2001 From: Jeremy Evans Date: Wed, 8 Mar 2017 10:19:02 -0800 Subject: Add worker_exec configuration option The worker_exec configuration option makes all worker processes exec after forking. This initializes the worker processes with separate memory layouts, defeating address space discovery attacks on operating systems supporting address space layout randomization, such as Linux, MacOS X, NetBSD, OpenBSD, and Solaris. Support for execing workers is very similar to support for reexecing the master process. The main difference is the worker's to_i and master pipes also need to be inherited after worker exec just as the listening sockets need to be inherited after reexec. Because execing working is similar to reexecing the master, this extracts a couple of methods from reexec (listener_sockets and close_sockets_on_exec), so they can be reused in worker_spawn. --- lib/unicorn/configurator.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'lib/unicorn/configurator.rb') diff --git a/lib/unicorn/configurator.rb b/lib/unicorn/configurator.rb index 7ed5ffa..f69f220 100644 --- a/lib/unicorn/configurator.rb +++ b/lib/unicorn/configurator.rb @@ -53,6 +53,7 @@ class Unicorn::Configurator server.logger.info("worker=#{worker.nr} ready") }, :pid => nil, + :worker_exec => false, :preload_app => false, :check_client_connection => false, :rewindable_input => true, # for Rack 2.x: (Rack::VERSION[0] <= 1), @@ -239,6 +240,15 @@ class Unicorn::Configurator set[:timeout] = seconds > max ? max : seconds end + # Whether to exec in each worker process after forking. This changes the + # memory layout of each worker process, which is a security feature designed + # to defeat possible address space discovery attacks. Note that using + # worker_exec only makes sense if you are not preloading the application, + # and will result in higher memory usage. + def worker_exec(bool) + set_bool(:worker_exec, bool) + end + # sets the current number of worker_processes to +nr+. Each worker # process will serve exactly one client at a time. You can # increment or decrement this value at runtime by sending SIGTTIN -- cgit v1.2.3-24-ge0c7