476622 - Assure that mod_perl children always receive a different srand() seed

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Max Kanat-Alexander]

We need to make sure that bug 476594 can never happen again. gozer recommends calling srand with a sufficiently random value in PerlChildInitHandler.

To me, the default srand later than Perl 5.004 sounds fine, particularly if it actually does use /dev/random on Unix platforms:

  http://perldoc.perl.org/functions/srand.html

Granted, it doesn't have /dev/random on Windows, but it still uses a fairly random seed.

Comment 1

[Philippe M. Chiasson (:gozer)]

Yes, that's correct, I forgot about that.

So, adding

PerlChildInitHandler "sub { srand(); }"

to httpd.conf should be sufficient.

Comment 2

[Max Kanat-Alexander]

Oh hmm. This isn't all that easy for us to automatically set up for our users, because all of our configuration happens inside of a <Directory> block in mod_perl.pl, where PerlChildInitHandler isn't valid. Is there anything that's valid inside a Directory block that would be appropriate to call srand inside of? Otherwise we have to tell people to update their httpd.conf, which isn't something I want to depend on in the future for Bugzilla to be secure, particularly as some people may not notice that they have to update it when they update Bugzilla.

Comment 3

[Max Kanat-Alexander]

Oh wait, nevermind. We can just add it outside of the Directory block. Duh.

Comment 4

[Max Kanat-Alexander]

Attachment: v1

Okay, here we go. I tested this on landfill and it doesn't seem to throw an error or anything.

Comment 5

[Philippe M. Chiasson (:gozer)]

Comment on attachment 360349 [details] [diff] [review]
v1

Looks good.

Comment 6

[Philippe M. Chiasson (:gozer)]

(In reply to comment #5)
> (From update of attachment 360349 [details] [diff] [review])
> Looks good.

Small nit on the comment.

I'd say something like:

# Make sure each httpd child receives a different random seed (bug 476622)

Comment 7

[Max Kanat-Alexander]

Might as well put it in 3.2, too, seems harmless and protects us against possible future mistakes.(In reply to comment #6)

> (In reply to comment #5)

> # Make sure each httpd child receives a different random seed (bug 476622)

  Ah, yeah, that's a good change, I'll do that.

Comment 8

[Max Kanat-Alexander]

tip/3.4:

Checking in mod_perl.pl;
/cvsroot/mozilla/webtools/bugzilla/mod_perl.pl,v  <--  mod_perl.pl
new revision: 1.11; previous revision: 1.10
done

3.2:

Checking in mod_perl.pl;
/cvsroot/mozilla/webtools/bugzilla/mod_perl.pl,v  <--  mod_perl.pl
new revision: 1.10.2.1; previous revision: 1.10
done