mjhjmtu

I'm currently trying to understand why Apache2 (2.4.25-3+deb9u2) running on Raspbian Stretch (Linux raspberrypi 4.9.41-v7+ #1023 SMP Tue Aug 8 16:00:15 BST 2017 armv7l GNU/Linux) is having a different view on the root-mountpoint than -for example- bash.

cat /proc/PID of Apache2/mountinfo gives the following output:

129 127 179:2 / / ro,noatime shared:80 master:1 - ext4 /dev/root ro,data=ordered

cat /proc/self/mountinfo executed from bash gives the following output:

15 0 179:2 / / ro,noatime shared:1 - ext4 /dev/root ro,data=ordered

As far as I have understood the explanations from man 7 mount_namespaces, https://lwn.net/Articles/689856/, https://lwn.net/Articles/690679/ and man 5 proc the output tells me that Apache is a slave to the peer group 1. It itself created a shared peer group with ID 80.

What I don't understand is, why that happens. I thought that systemd is in control of that and so I created the file /etc/systemd/system/apache2.service with the following content:

.include /lib/systemd/system/apache2.service

[Service]
MountFlags=shared

But obviously this didn't help. There's also no difference when I remove the MountFlags line.

So next to understanding why the situation is like it is, I would like to know if there's any way to prevent Apache becoming a slave to the root mount peer group.

Furthermore, if I remount the root directory to be writeable by mount -o remount,rw / in bash, this is not propagated into the Apache2 mount namespace. Example, starting with the mountinfo from above:

# mount -o remount,rw /
# cat /proc/self/mountinfo
15 0 179:2 / / rw,noatime shared:1 - ext4 /dev/root rw,data=ordered
# cat /proc/PID of Apache2/mountinfo
129 127 179:2 / / ro,noatime shared:80 master:1 - ext4 /dev/root rw,data=ordered

Is this part of any security feature of Apache?

Update 1: If I (re)start the Apache2 service while root is mounted rw, the remounts will be propagated to the Apache2 mount namespace. Only if the Apache2 service is started while root is ro, it does not work?!

Remove the PrivateTmp=true setting in apache2.service.

https://www.freedesktop.org/software/systemd/man/systemd.exec.html :

If true, sets up a new file system namespace for the executed processes and mounts private /tmp and /var/tmp directories inside it that is not shared by processes outside of the namespace.