apache, subversion and deps in main

2015-09-05 00:01:04 +03:00
parent bfa8722fab
commit 31c7749ca4
54 changed files with 3883 additions and 0 deletions
@@ -0,0 +1,10 @@
+#
+# This configuration file allows the manual to be accessed at 
+# http://localhost/manual/
+#
+AliasMatch ^/manual(?:/(?:de|en|fr|ja|ko|ru))?(/.*)?$ "/usr/share/doc/apache/manual$1"
+<Directory "/usr/share/doc/apache/manual">
+    Options Indexes
+    AllowOverride None
+    Require all granted
+</Directory>
@@ -0,0 +1,92 @@
+### Section 3: Virtual Hosts
+#
+# VirtualHost: If you want to maintain multiple domains/hostnames on your
+# machine you can setup VirtualHost containers for them. Most configurations
+# use only name-based virtual hosts so the server doesn't need to worry about
+# IP addresses. This is indicated by the asterisks in the directives below.
+#
+# Please see the documentation at 
+# <URL:http://httpd.apache.org/docs-2.0/vhosts/>
+# for further details before you try to setup virtual hosts.
+#
+# You may use the command line option '-S' to verify your virtual host
+# configuration.
+
+#
+# Use name-based virtual hosting.
+#
+NameVirtualHost *:80
+
+#
+# VirtualHost example:
+# Almost any Apache directive may go into a VirtualHost container.
+# The first VirtualHost section is used for requests without a known
+# server name.
+#
+#<VirtualHost *:80>
+#    ServerAdmin webmaster@dummy-host.example.com
+#    DocumentRoot /www/docs/dummy-host.example.com
+#    ServerName dummy-host.example.com
+#    ErrorLog @rel_logfiledir@/dummy-host.example.com-error_log
+#    CustomLog @rel_logfiledir@/dummy-host.example.com-access_log common
+#</VirtualHost>
+
+
+#
+# The First Virtual Host is also your DEFAULT Virtual Host.
+# This means any requests that do not match any other vhosts will 
+# goto this virtual host.
+#
+
+<IfDefine DEFAULT_VHOST>
+<VirtualHost *:80>
+    #
+    # DocumentRoot: The directory out of which you will serve your
+    # documents. By default, all requests are taken from this directory, but
+    # symbolic links and aliases may be used to point to other locations.
+    #
+    DocumentRoot "/var/www/localhost/htdocs"
+
+    #
+    # This should be changed to whatever you set DocumentRoot to.
+    #
+    <Directory "/var/www/localhost/htdocs">
+
+        #
+        # Possible values for the Options directive are "None", "All",
+        # or any combination of:
+        #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+        #
+        # Note that "MultiViews" must be named *explicitly* --- "Options All"
+        # doesn't give it to you.
+        #
+        # The Options directive is both complicated and important.  Please see
+        # http://httpd.apache.org/docs-2.0/mod/core.html#options
+        # for more information.
+        #
+        Options Indexes FollowSymLinks
+
+        #
+        # AllowOverride controls what directives may be placed in .htaccess files.
+        # It can be "All", "None", or any combination of the keywords:
+        #   Options FileInfo AuthConfig Limit
+        #
+        AllowOverride None
+
+        #
+        # Controls who can get stuff from this server.
+        #
+        Order allow,deny
+        Allow from all
+    </Directory>
+	
+    <IfModule peruser.c>
+        # this must match a Processor
+        ServerEnvironment apache apache
+        
+        # these are optional - defaults to the values specified in httpd.conf
+        MinSpareProcessors 4
+        MaxProcessors 20
+    </IfModule>
+</VirtualHost>
+</IfDefine>
@@ -0,0 +1,87 @@
+<IfDefine SSL>
+  <IfModule !mod_ssl.c>
+    LoadModule ssl_module    modules/mod_ssl.so
+  </IfModule>
+</IfDefine>
+
+<IfModule mod_ssl.c>
+#
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailing information about these 
+# directives see <URL:http://httpd.apache.org/docs-2.0/mod/mod_ssl.html>
+# 
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+
+#
+# Pseudo Random Number Generator (PRNG):
+# Configure one or more sources to seed the PRNG of the SSL library.
+# The seed data should be of good random quality.
+# WARNING! On some platforms /dev/random blocks if not enough entropy
+# is available. This means you then cannot use the /dev/random device
+# because it would lead to very long connection times (as long as
+# it requires to make more entropy available). But usually those
+# platforms additionally provide a /dev/urandom device which doesn't
+# block. So, if available, use this one instead. Read the mod_ssl User
+# Manual for more details.
+#
+# Note: This must come before the <IfDefine SSL> container to support
+#       starting without SSL on platforms with no /dev/random equivalent
+#       but a statically compiled-in mod_ssl.
+#
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed startup file:/dev/urandom 512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+#
+# When we also provide SSL we have to listen to the 
+# standard HTTP port (see above) and to the HTTPS port
+#
+
+Listen 443
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#
+#   Some MIME-types for downloading Certificates and CRLs
+#
+
+<IfModule mod_mime.c>
+AddType application/x-x509-ca-cert .crt
+AddType application/x-pkcs7-crl    .crl
+</IfModule>
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#SSLSessionCache        none
+#SSLSessionCache        shmht:logs/ssl_scache(512000)
+#SSLSessionCache        shmcb:logs/ssl_scache(512000)
+#SSLSessionCache        dbm:/var/cache/apache2/ssl_scache
+SSLSessionCache         shm:/var/cache/apache2/ssl_scache(512000)
+SSLSessionCacheTimeout  300
+
+#   Semaphore:
+#   Configure the path to the mutual exclusion semaphore the
+#   SSL engine uses internally for inter-process synchronization. 
+
+SSLMutex  file:/var/cache/apache2/ssl_mutex
+</IfModule>
@@ -0,0 +1,190 @@
+<IfDefine SSL>
+
+  # We now wrap the entire default vhost in a seperate IfDefine to fix bug
+  # 100624. If you are using this default vhost, add it to /etc/conf.d/apache2
+  <IfDefine SSL_DEFAULT_VHOST>
+
+<IfModule mod_ssl.c>
+##
+## SSL Virtual Host Context
+##
+
+<VirtualHost _default_:443>
+
+#   General setup for the virtual host
+DocumentRoot "/var/www/localhost/htdocs"
+ServerName localhost:443
+ServerAdmin root@localhost
+ErrorLog logs/ssl_error_log
+<IfModule mod_log_config.c>
+	TransferLog logs/ssl_access_log
+</IfModule>
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
+
+#   Server Certificate:
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that a kill -HUP will prompt again. A test
+#   certificate can be generated with `make certificate' under
+#   built time. Keep in mind that if you've both a RSA and a DSA
+#   certificate you can configure both in parallel (to also allow
+#   the use of DSA ciphers, etc.)
+SSLCertificateFile conf/ssl/server.crt
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+
+SSLCertificateKeyFile conf/ssl/server.key
+
+#   Server Certificate Chain:
+#   Point SSLCertificateChainFile at a file containing the
+#   concatenation of PEM encoded CA certificates which form the
+#   certificate chain for the server certificate. Alternatively
+#   the referenced file can be the same as SSLCertificateFile
+#   when the CA certificates are directly appended to the server
+#   certificate for convinience.
+#SSLCertificateChainFile conf/ssl/ca.crt
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+#   Note: Inside SSLCACertificatePath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCACertificatePath conf/ssl/ssl.crt
+#SSLCACertificateFile conf/ssl/ca-bundle.crt
+
+#   Certificate Revocation Lists (CRL):
+#   Set the CA revocation path where to find CA CRLs for client
+#   authentication or alternatively one huge file containing all
+#   of them (file must be PEM encoded)
+#   Note: Inside SSLCARevocationPath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCARevocationPath conf/ssl/ssl.crl
+#SSLCARevocationFile conf/ssl/ca-bundle.crl
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o CompatEnvVars:
+#     This exports obsolete environment variables for backward compatibility
+#     to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
+#     to provide compatibility to existing CGI scripts.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
+
+<Files ~ "\.(cgi|shtml|phtml|php?)$">
+    SSLOptions +StdEnvVars
+</Files>
+
+<Directory "/var/www/localhost/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is send or allowed to received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+<IfModule mod_setenvif.c>
+    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown \
+    downgrade-1.0 force-response-1.0
+</IfModule>
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+<IfModule mod_log_config.c>
+CustomLog logs/ssl_request_log \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+</IfModule>
+
+<IfModule mod_rewrite.c>
+RewriteEngine On
+RewriteOptions inherit
+</IfModule>
+
+</VirtualHost>                                  
+
+</IfModule>
+
+  </IfDefine>
+</IfDefine>
@@ -0,0 +1,31 @@
+<IfDefine DAV>
+  <IfModule !mod_dav.c>
+    LoadModule dav_module    modules/mod_dav.so
+  </IfModule>
+</IfDefine>
+
+<IfDefine DAV_FS>
+  <IfModule !mod_dav_fs.c>
+    LoadModule dav_fs_module   modules/mod_dav_fs.so
+  </IfModule>
+</IfDefine>
+
+<IfModule mod_dav.c>
+
+    DavMinTimeout 600
+#	<Location /mypages>
+#		Options None
+#		Dav On
+#		<Limit PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
+#			Require user greg
+#		</Limit>
+#	</Location>
+
+</IfModule>
+
+<IfModule mod_dav_fs.c>
+
+    # Location of the WebDAV lock database.
+    DavLockDB /var/lib/dav/lockdb
+
+</IfModule>
@@ -0,0 +1,40 @@
+<IfDefine LDAP>
+  <IfModule !util_ldap.c>
+    LoadModule ldap_module    modules/mod_ldap.so
+  </IfModule>
+</IfDefine>
+
+<IfDefine AUTH_LDAP>
+  <IfModule !mod_auth_ldap.c>
+    LoadModule auth_ldap_module   modules/mod_auth_ldap.so
+  </IfModule>
+</IfDefine>
+
+# Examples below are taken from the online documentation
+# Refer to:
+# http://localhost/manual/mod/mod_ldap.html
+# http://localhost/manual/mod/mod_auth_ldap.html
+
+<IfModule util_ldap.c>
+
+    LDAPSharedCacheSize 200000
+    LDAPCacheEntries 1024
+    LDAPCacheTTL 600
+    LDAPOpCacheEntries 1024
+    LDAPOpCacheTTL 600
+
+    <Location /ldap-status>
+        SetHandler ldap-status
+        Order deny,allow
+        Deny from all
+        Allow from 127.0.0.1
+    </Location>
+
+</IfModule>
+
+<IfModule mod_auth_ldap.c>
+
+    #AuthLDAPURL ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)
+    #require valid-user
+
+</IfModule>
@@ -0,0 +1,15 @@
+[Unit]
+Description=Apache Web Server
+After=network.target remote-fs.target nss-lookup.target
+
+[Service]
+Type=notify
+EnvironmentFile=/etc/conf.d/apache2
+PIDFile=/run/apache2.pid
+ExecStart=/usr/sbin/apache2 -d /usr/lib/apache2/ -f /etc/apache2/httpd.conf $APACHE2_OPTS -k start
+ExecReload=/usr/sbin/apache2 -d /usr/lib/apache2/ -f /etc/apache2/httpd.conf $APACHE2_OPTS -k graceful
+ExecStop=/usr/sbin/apache2 -d /usr/lib/apache2/ -f /etc/apache2/httpd.conf $APACHE2_OPTS -k graceful-stop
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,48 @@
+# Original works belongs to Gentoo Linux
+
+# Config file for /etc/conf. d/apache2
+
+# When you install a module it is easy to activate or deactivate the modules
+# and other features of apache using the APACHE2_OPTS line. Every module should
+# install a configuration in /etc/apache2/modules.d. In that file will be an
+# <IfDefine NNN> where NNN is the option to enable that module.
+# Here are the options available in the default configuration:
+#   USERDIR   Enables /~username mapping to /home/username/public_html
+#   INFO      Enables mod_info, a useful module for debugging
+#   PROXY     Enables mod_proxy
+#   DAV       Enables mod_dav
+#   DAV_FS    Enables mod_dav_fs (you should enable this when you enable DAV
+#             unless you know what you are doing)
+#   SSL       Enables SSL
+#   SSL_DEFAULT_VHOST  Enables default vhost for SSL (you should enable this
+#                      when you enable SSL unless you know what you are doing)
+#   LDAP      Enables mod_ldap
+#   AUTH_LDAP Enables authentication through mod_ldap
+#   DEFAULT_VHOST Enables the default virtual host in /var/www/localhost/htdocs
+APACHE2_OPTS="-D DEFAULT_VHOST -D USERDIR"
+
+# Extended options for advanced uses of Apache ONLY
+# You don't need to edit these unless you are doing crazy Apache stuff
+# As not having them set correctly, or feeding in an incorrect configuration
+# via them will result in Apache failing to start
+# YOU HAVE BEEN WARNED.
+
+# ServerRoot setting
+#SERVERROOT=/usr/lib/apache2
+
+# Configuration file location
+# - If this does NOT start with a '/', then it is treated relative to
+# $SERVERROOT by Apache
+#CONFIGFILE=/etc/apache2/httpd.conf
+
+# Location to log startup errors to
+# They are normally dumped to your terminal.
+#STARTUPERRORLOG="/var/log/apache2/startuperror.log"
+
+# Environment variables to keep
+# All environment variables are cleared from apache
+# Use this to preserve some of them
+# NOTE!!! It's very important that this contains PATH
+# Also, it will fail if the _value_ of any of these variables contains a space
+KEEPENV="PATH"
+
@@ -0,0 +1,83 @@
+
+- fail gracefully if links is not installed on target system
+- source sysconfig/httpd for custom env. vars etc.
+- make httpd -t work even in SELinux
+- pass $OPTIONS to all $HTTPD invocation
+
+Upstream-HEAD: vendor
+Upstream-2.0: vendor
+Upstream-Status: Vendor-specific changes for better initscript integration
+
+--- httpd-2.4.1/support/apachectl.in.apctl
+++ httpd-2.4.1/support/apachectl.in
+@@ -44,19 +44,25 @@
+ # the path to your httpd binary, including options if necessary
+ HTTPD='@exp_sbindir@/@progname@'
+ #
+-# pick up any necessary environment variables
+-if test -f @exp_sbindir@/envvars; then
+-  . @exp_sbindir@/envvars
+-fi
+ #
+ # a command that outputs a formatted text version of the HTML at the
+ # url given on the command line.  Designed for lynx, however other
+ # programs may work.  
+-LYNX="@LYNX_PATH@ -dump"
+if [ -x "@LYNX_PATH@" ]; then
+  LYNX="@LYNX_PATH@ -dump"
+else
+  LYNX=none
+fi
+ #
+ # the URL to your server's mod_status status page.  If you do not
+ # have one, then status and fullstatus will not work.
+ STATUSURL="http://localhost:@PORT@/server-status"
+
+# Source /etc/conf.d/apache2 for $HTTPD setting, etc.
+if [ -r /etc/conf.d/apache2 ]; then
+   . /etc/conf.d/apache2
+fi
+
+ #
+ # Set this variable to a command that increases the maximum
+ # number of file descriptors allowed per child process. This is
+@@ -76,9 +82,16 @@
+     ARGV="-h"
+ fi
+ 
+function checklynx() {
+if [ "$LYNX" = "none" ]; then
+   echo "The 'links' package is required for this functionality."
+   exit 8
+fi
+}
+
+ case $ACMD in
+ start|stop|restart|graceful|graceful-stop)
+-    $HTTPD -k $ARGV
+    $HTTPD $OPTIONS -k $ARGV
+     ERROR=$?
+     ;;
+ startssl|sslstart|start-SSL)
+@@ -88,17 +101,18 @@
+     ERROR=2
+     ;;
+ configtest)
+-    $HTTPD -t
+-    ERROR=$?
+    testconfig
+     ;;
+ status)
+    checklynx
+     $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
+     ;;
+ fullstatus)
+    checklynx
+     $LYNX $STATUSURL
+     ;;
+ *)
+-    $HTTPD "$@"
+    $HTTPD $OPTIONS "$@"
+     ERROR=$?
+ esac
+ 
@@ -0,0 +1,35 @@
+
+Bump up the core size limit if CoreDumpDirectory is
+configured.
+
+Upstream-Status: Was discussed but there are competing desires;
+	there are portability oddities here too.
+
+--- httpd-2.4.1/server/core.c.corelimit
+++ httpd-2.4.1/server/core.c
+@@ -4433,6 +4433,25 @@ static int core_post_config(apr_pool_t *
+     }
+     apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper,
+                               apr_pool_cleanup_null);
+
+#ifdef RLIMIT_CORE
+    if (ap_coredumpdir_configured) {
+        struct rlimit lim;
+
+        if (getrlimit(RLIMIT_CORE, &lim) == 0 && lim.rlim_cur == 0) {
+            lim.rlim_cur = lim.rlim_max;
+            if (setrlimit(RLIMIT_CORE, &lim) == 0) {
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
+                             "core dump file size limit raised to %lu bytes",
+                             lim.rlim_cur);
+            } else {
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, errno, NULL,
+                             "core dump file size is zero, setrlimit failed");
+            }
+        }
+    }
+#endif
+
+     return OK;
+ }
+ 
@@ -0,0 +1,19 @@
+
+Link straight against .la files.
+
+Upstream-Status: vendor specific
+
+--- httpd-2.4.1/configure.in.deplibs
+++ httpd-2.4.1/configure.in
+@@ -707,9 +707,9 @@ APACHE_HELP_STRING(--with-suexec-umask,u
+ 
+ dnl APR should go after the other libs, so the right symbols can be picked up
+ if test x${apu_found} != xobsolete; then
+-  AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool --libs`"
+  AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
+ fi
+-AP_LIBS="$AP_LIBS `$apr_config --link-libtool --libs`" 
+AP_LIBS="$AP_LIBS `$apr_config --link-libtool`" 
+ APACHE_SUBST(AP_LIBS)
+ APACHE_SUBST(AP_BUILD_SRCLIB_DIRS)
+ APACHE_SUBST(AP_CLEAN_SRCLIB_DIRS)
@@ -0,0 +1,26 @@
+
+- Fix config for /icons/ dir to allow symlink to poweredby.png.
+- Avoid using coredump GIF for a directory called "core"
+
+Upstream-Status: vendor specific patch
+
+--- httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in.icons
+++ httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable Ver
+ Alias /icons/ "@exp_iconsdir@/"
+ 
+ <Directory "@exp_iconsdir@">
+-    Options Indexes MultiViews
+    Options Indexes MultiViews FollowSymlinks
+     AllowOverride None
+     Require all granted
+ </Directory>
+@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi
+ AddIcon /icons/uuencoded.gif .uu
+ AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+ AddIcon /icons/tex.gif .tex
+-AddIcon /icons/bomb.gif core
+AddIcon /icons/bomb.gif core.
+ 
+ AddIcon /icons/back.gif ..
+ AddIcon /icons/hand.right.gif README
@@ -0,0 +1,45 @@
+
+Upstream-Status: vendor specific patch
+
+diff --git a/support/apachectl.in b/support/apachectl.in
+index c6ac3ea..2599386 100644
+--- a/support/apachectl.in
+++ b/support/apachectl.in
+@@ -100,9 +100,24 @@ fi
+ ERROR=$?
+ }
+ 
+if [ "x$2" != "x" ] ; then
+    echo Passing arguments to httpd using apachectl is no longer supported.
+    echo You can only start/stop/restart httpd using this script.
+    echo If you want to pass extra arguments to httpd, edit the
+    echo /etc/sysconfig/httpd config file.
+fi
+
+ case $ACMD in
+-start|stop|restart|graceful|graceful-stop)
+-    $HTTPD $OPTIONS -k $ARGV
+start|stop|restart|status)
+    /usr/bin/systemctl $ACMD httpd.service
+    ERROR=$?
+    ;;
+graceful)
+    /usr/bin/systemctl restart httpd.service
+    ERROR=$?
+    ;;
+graceful-stop)
+    /usr/bin/systemctl stop httpd.service
+     ERROR=$?
+     ;;
+ startssl|sslstart|start-SSL)
+@@ -114,10 +129,6 @@ startssl|sslstart|start-SSL)
+ configtest)
+     testconfig
+     ;;
+-status)
+-    checklynx
+-    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
+-    ;;
+ fullstatus)
+     checklynx
+     $LYNX $STATUSURL
@@ -0,0 +1,56 @@
+--- httpd-2.4.3/support/apxs.in.apxs
+++ httpd-2.4.3/support/apxs.in
+@@ -25,7 +25,18 @@ package apxs;
+ 
+ my %config_vars = ();
+ 
+-my $installbuilddir = "@exp_installbuilddir@";
+# Awful hack to make apxs libdir-agnostic:
+my $pkg_config = "/usr/bin/pkg-config";
+if (! -x "$pkg_config") {
+    error("$pkg_config not found!");
+    exit(1);
+}
+
+my $libdir = `pkg-config --variable=libdir apr-1`;
+chomp $libdir;
+
+my $installbuilddir = $libdir . "/apache2/build";
+
+ get_config_vars("$installbuilddir/config_vars.mk",\%config_vars);
+ 
+ # read the configuration variables once
+@@ -275,7 +286,7 @@ if ($opt_g) {
+     $data =~ s|%NAME%|$name|sg;
+     $data =~ s|%TARGET%|$CFG_TARGET|sg;
+     $data =~ s|%PREFIX%|$prefix|sg;
+-    $data =~ s|%INSTALLBUILDDIR%|$installbuilddir|sg;
+    $data =~ s|%LIBDIR%|$libdir|sg;
+ 
+     my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s);
+ 
+@@ -453,11 +464,11 @@ if ($opt_c) {
+     my $ldflags = "$CFG_LDFLAGS";
+     if ($opt_p == 1) {
+         
+-        my $apr_libs=`$apr_config --cflags --ldflags --link-libtool --libs`;
+        my $apr_libs=`$apr_config --cflags --ldflags --link-libtool`;
+         chomp($apr_libs);
+         my $apu_libs="";
+         if ($apr_major_version < 2) {
+-            $apu_libs=`$apu_config --ldflags --link-libtool --libs`;
+            $apu_libs=`$apu_config --ldflags --link-libtool`;
+             chomp($apu_libs);
+         }
+         
+@@ -672,8 +683,8 @@ __DATA__
+ 
+ builddir=.
+ top_srcdir=%PREFIX%
+-top_builddir=%PREFIX%
+-include %INSTALLBUILDDIR%/special.mk
+top_builddir=%LIBDIR%/apache2
+include %LIBDIR%/apache2/build/special.mk
+ 
+ #   the used tools
+ APXS=apxs
@@ -0,0 +1,163 @@
+--- httpd-2.4.3/modules/arch/unix/config5.m4.systemd
+++ httpd-2.4.3/modules/arch/unix/config5.m4
+@@ -18,6 +18,19 @@ APACHE_MODULE(privileges, Per-virtualhos
+   fi
+ ])
+ 
+
+APACHE_MODULE(systemd, Systemd support, , , $unixd_mods_enabled, [
+  AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
+  AC_CHECK_HEADERS(systemd/sd-daemon.h, [ap_HAVE_SD_DAEMON_H="yes"], [ap_HAVE_SD_DAEMON_H="no"])
+  if test $ap_HAVE_SD_DAEMON_H = "no" || test -z "${SYSTEMD_LIBS}"; then
+    AC_MSG_WARN([Your system does not support systemd.])
+    enable_systemd="no"
+  else
+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
+    enable_systemd="yes"
+  fi
+])
+
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.3/modules/arch/unix/mod_systemd.c.systemd
+++ httpd-2.4.3/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,138 @@
+/* Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ */
+
+#include <stdint.h>
+#include <ap_config.h>
+#include "ap_mpm.h"
+#include <http_core.h>
+#include <http_log.h>
+#include <apr_version.h>
+#include <apr_pools.h>
+#include <apr_strings.h>
+#include "unixd.h"
+#include "scoreboard.h"
+#include "mpm_common.h"
+
+#include "systemd/sd-daemon.h"
+
+#if APR_HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+#define KBYTE 1024
+
+static pid_t pid;	/* PID of the main httpd instance */
+static int server_limit, thread_limit, threads_per_child, max_servers;
+static time_t last_update_time;
+static unsigned long last_update_access;
+static unsigned long last_update_kbytes;
+
+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
+{
+    int rv;
+    last_update_time = time(0);
+
+    ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
+    ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
+    ap_mpm_query(AP_MPMQ_MAX_THREADS, &threads_per_child);
+    /* work around buggy MPMs */
+    if (threads_per_child == 0)
+        threads_per_child = 1;
+    ap_mpm_query(AP_MPMQ_MAX_DAEMONS, &max_servers);
+
+    pid = getpid();
+    
+    rv = sd_notifyf(0, "READY=1\n"
+                    "STATUS=Processing requests...\n"
+                    "MAINPID=%lu",
+                    (unsigned long) pid);
+    if (rv < 0) {
+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, 
+                     "sd_notifyf returned an error %d", rv);
+    }
+
+    return OK;
+}
+
+static int systemd_monitor(apr_pool_t *p, server_rec *s)
+{
+    int i, j, res, rv;
+    process_score *ps_record;
+    worker_score *ws_record;
+    unsigned long access = 0;
+    unsigned long bytes = 0;
+    unsigned long kbytes = 0;
+    char bps[5];
+    time_t now = time(0);
+    time_t elapsed = now - last_update_time;
+
+    for (i = 0; i < server_limit; ++i) {
+        ps_record = ap_get_scoreboard_process(i);
+        for (j = 0; j < thread_limit; ++j) {
+            ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
+            if (ap_extended_status && !ps_record->quiescing && ps_record->pid) {
+                res = ws_record->status;
+                if (ws_record->access_count != 0 || 
+                    (res != SERVER_READY && res != SERVER_DEAD)) {
+                    access += ws_record->access_count;
+                    bytes += ws_record->bytes_served;
+                    if (bytes >= KBYTE) {
+                        kbytes += (bytes >> 10);
+                        bytes = bytes & 0x3ff;
+                    }
+                }
+            }
+        }
+    }
+
+    apr_strfsize((unsigned long)(KBYTE *(float) (kbytes - last_update_kbytes)
+                                 / (float) elapsed), bps);
+
+    rv = sd_notifyf(0, "READY=1\n"
+                    "STATUS=Total requests: %lu; Current requests/sec: %.3g; "
+                    "Current traffic: %sB/sec\n", access,
+                    ((float)access - last_update_access) / (float) elapsed, bps);
+    if (rv < 0) {
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00000)
+                     "sd_notifyf returned an error %d", rv);
+    }
+
+    last_update_access = access;
+    last_update_kbytes = kbytes;
+    last_update_time = now;
+
+    return DECLINED;
+}
+
+static void systemd_register_hooks(apr_pool_t *p)
+{
+    /* We know the PID in this hook ... */
+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
+    /* Used to update httpd's status line using sd_notifyf */
+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+module AP_MODULE_DECLARE_DATA systemd_module =
+{
+    STANDARD20_MODULE_STUFF,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    systemd_register_hooks,
+};
@@ -0,0 +1,83 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 15993f1..53ed6f1 100644
+--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
+@@ -55,6 +55,7 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s)
+     mc = (SSLModConfigRec *)apr_palloc(pool, sizeof(*mc));
+     mc->pPool = pool;
+     mc->bFixed = FALSE;
+    mc->sni_required = FALSE;
+ 
+     /*
+      * initialize per-module configuration
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index bf1f0e4..a7523de 100644
+--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
+@@ -409,7 +409,7 @@ int ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+     /*
+      * Configuration consistency checks
+      */
+-    ssl_init_CheckServers(base_server, ptemp);
+    ssl_init_CheckServers(mc, base_server, ptemp);
+ 
+     /*
+      *  Announce mod_ssl and SSL library in HTTP Server field
+@@ -1475,7 +1475,7 @@ void ssl_init_ConfigureServer(server_rec *s,
+     }
+ }
+ 
+-void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p)
+void ssl_init_CheckServers(SSLModConfigRec *mc, server_rec *base_server, apr_pool_t *p)
+ {
+     server_rec *s, *ps;
+     SSLSrvConfigRec *sc;
+@@ -1557,6 +1557,7 @@ void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p)
+     }
+ 
+     if (conflict) {
+        mc->sni_required = TRUE;
+ #ifdef OPENSSL_NO_TLSEXT
+         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)
+                      "Init: You should not use name-based "
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index bc9e26b..2460f01 100644
+--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
+@@ -164,6 +164,7 @@ int ssl_hook_ReadReq(request_rec *r)
+         return DECLINED;
+     }
+ #ifndef OPENSSL_NO_TLSEXT
+    if (myModConfig(r->server)->sni_required) {
+     if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
+         char *host, *scope_id;
+         apr_port_t port;
+@@ -206,6 +207,7 @@ int ssl_hook_ReadReq(request_rec *r)
+                      " virtual host");
+         return HTTP_FORBIDDEN;
+     }
+    }
+ #endif
+     SSL_set_app_data2(ssl, r);
+ 
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index 75fc0e3..31dbfa9 100644
+--- a/modules/ssl/ssl_private.h
+++ b/modules/ssl/ssl_private.h
+@@ -554,6 +554,7 @@ typedef struct {
+     struct {
+         void *pV1, *pV2, *pV3, *pV4, *pV5, *pV6, *pV7, *pV8, *pV9, *pV10;
+     } rCtx;
+    BOOL            sni_required;
+ } SSLModConfigRec;
+ 
+ /** Structure representing configured filenames for certs and keys for
+@@ -786,7 +787,7 @@ const char *ssl_cmd_SSLFIPS(cmd_parms *cmd, void *dcfg, int flag);
+ int          ssl_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
+ void         ssl_init_Engine(server_rec *, apr_pool_t *);
+ void         ssl_init_ConfigureServer(server_rec *, apr_pool_t *, apr_pool_t *, SSLSrvConfigRec *);
+-void         ssl_init_CheckServers(server_rec *, apr_pool_t *);
+void         ssl_init_CheckServers(SSLModConfigRec *mc, server_rec *, apr_pool_t *);
+ STACK_OF(X509_NAME)
+             *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *);
+ void         ssl_init_Child(apr_pool_t *, server_rec *);
@@ -0,0 +1,250 @@
+# ./pullrev.sh 1337344 1341905 1342065 1341930
+
+suexec enhancements:
+
+1) use syslog for logging
+2) use capabilities not setuid/setgid root binary
+
+http://svn.apache.org/viewvc?view=revision&revision=1337344
+http://svn.apache.org/viewvc?view=revision&revision=1341905
+http://svn.apache.org/viewvc?view=revision&revision=1342065
+http://svn.apache.org/viewvc?view=revision&revision=1341930
+
+--- httpd-2.4.4/configure.in.r1337344+
+++ httpd-2.4.4/configure.in
+@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
+ 
+ AC_ARG_WITH(suexec-logfile,
+ APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
+-  AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
+  if test "x$withval" = "xyes"; then
+    AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
+  fi
+])
+
+AC_ARG_WITH(suexec-syslog,
+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
+  if test $withval = "yes"; then
+    if test "x${with_suexec_logfile}" != "xno"; then
+      AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
+      AC_MSG_ERROR([suexec does not support both logging to file and syslog])
+    fi
+    AC_CHECK_FUNCS([vsyslog], [], [
+       AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
+    AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
+  fi    
+])
+
+ 
+ AC_ARG_WITH(suexec-safepath,
+ APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
+@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask,
+ APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[
+   AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] )
+ 
+INSTALL_SUEXEC=setuid
+AC_ARG_ENABLE([suexec-capabilities], 
+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [
+INSTALL_SUEXEC=caps
+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, 
+          [Enable if suexec is installed with Linux capabilities, not setuid])
+])
+APACHE_SUBST(INSTALL_SUEXEC)
+
+ dnl APR should go after the other libs, so the right symbols can be picked up
+ if test x${apu_found} != xobsolete; then
+   AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
+--- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+
+++ httpd-2.4.4/docs/manual/suexec.html.en
+@@ -372,6 +372,21 @@
+       together with the <code>--enable-suexec</code> option to let
+       APACI accept your request for using the suEXEC feature.</dd>
+ 
+      <dt><code>--enable-suexec-capabilities</code></dt>
+
+      <dd><strong>Linux specific:</strong> Normally,
+      the <code>suexec</code> binary is installed "setuid/setgid
+      root", which allows it to run with the full privileges of the
+      root user.  If this option is used, the <code>suexec</code>
+      binary will instead be installed with only the setuid/setgid
+      "capability" bits set, which is the subset of full root
+      priviliges required for suexec operation.  Note that
+      the <code>suexec</code> binary may not be able to write to a log
+      file in this mode; it is recommended that the
+      <code>--with-suexec-syslog --without-suexec-logfile</code>
+      options are used in conjunction with this mode, so that syslog
+      logging is used instead.</dd>
+
+       <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+ 
+       <dd>The path to the <code>suexec</code> binary must be hard-coded
+@@ -433,6 +448,12 @@
+       "<code>suexec_log</code>" and located in your standard logfile
+       directory (<code>--logfiledir</code>).</dd>
+ 
+      <dt><code>--with-suexec-syslog</code></dt>
+
+      <dd>If defined, suexec will log notices and errors to syslog
+      instead of a logfile.  This option must be combined
+      with <code>--without-suexec-logfile</code>.</dd>
+
+       <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+ 
+       <dd>Define a safe PATH environment to pass to CGI
+@@ -550,9 +571,12 @@ Group webgroup
+ 
+     <p>The suEXEC wrapper will write log information
+     to the file defined with the <code>--with-suexec-logfile</code>
+-    option as indicated above. If you feel you have configured and
+-    installed the wrapper properly, have a look at this log and the
+-    error_log for the server to see where you may have gone astray.</p>
+    option as indicated above, or to syslog if <code>--with-suexec-syslog</code>
+    is used. If you feel you have configured and
+    installed the wrapper properly, have a look at the log and the
+    error_log for the server to see where you may have gone astray. 
+    The output of <code>"suexec -V"</code> will show the options
+    used to compile suexec, if using a binary distribution.</p>
+ 
+ </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+ <div class="section">
+@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined')
+     prettyPrint();
+ }
+ //--><!]]></script>
+-</body></html>
+\ No newline at end of file
+</body></html>
+--- httpd-2.4.4/Makefile.in.r1337344+
+++ httpd-2.4.4/Makefile.in
+@@ -238,11 +238,22 @@ install-man:
+ 	  cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \
+ 	fi
+ 
+-install-suexec:
+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC)
+
+install-suexec-binary:
+ 	@if test -f $(builddir)/support/suexec; then \
+             test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \
+             $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \
+-            chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
+	fi
+
+install-suexec-setuid:
+	@if test -f $(builddir)/support/suexec; then \
+	    chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
+	fi
+
+install-suexec-caps:
+	@if test -f $(builddir)/support/suexec; then \
+            setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \
+ 	fi
+ 
+ suexec:
+--- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+
+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c
+@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d
+     return NULL;
+ }
+ 
+#ifdef AP_SUEXEC_CAPABILITIES
+/* If suexec is using capabilities, don't test for the setuid bit. */
+#define SETUID_TEST(finfo) (1)
+#else
+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID)
+#endif
+
+ static int
+ unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+                  apr_pool_t *ptemp)
+@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_
+     ap_unixd_config.suexec_enabled = 0;
+     if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp))
+          == APR_SUCCESS) {
+-        if ((wrapper.protection & APR_USETID) && wrapper.user == 0
+        if (SETUID_TEST(wrapper) && wrapper.user == 0
+             && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) {
+             ap_unixd_config.suexec_enabled = 1;
+             ap_unixd_config.suexec_disabled_reason = "";
+--- httpd-2.4.4/support/suexec.c.r1337344+
+++ httpd-2.4.4/support/suexec.c
+@@ -58,6 +58,10 @@
+ #include <grp.h>
+ #endif
+ 
+#ifdef AP_LOG_SYSLOG
+#include <syslog.h>
+#endif
+
+ #if defined(PATH_MAX)
+ #define AP_MAXPATH PATH_MAX
+ #elif defined(MAXPATHLEN)
+@@ -69,7 +73,20 @@
+ #define AP_ENVBUF 256
+ 
+ extern char **environ;
+
+#ifdef AP_LOG_SYSLOG
+/* Syslog support. */
+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV)
+#define AP_LOG_FACILITY LOG_AUTHPRIV
+#elif !defined(AP_LOG_FACILITY)
+#define AP_LOG_FACILITY LOG_AUTH
+#endif
+
+static int log_open;
+#else
+/* Non-syslog support. */
+ static FILE *log = NULL;
+#endif
+ 
+ static const char *const safe_env_lst[] =
+ {
+@@ -137,7 +154,14 @@ static void err_output(int is_error, con
+ 
+ static void err_output(int is_error, const char *fmt, va_list ap)
+ {
+-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+    if (!log_open) {
+        openlog("suexec", LOG_PID, AP_LOG_FACILITY);
+        log_open = 1;
+    }
+
+    vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
+#elif defined(AP_LOG_EXEC)
+     time_t timevar;
+     struct tm *lt;
+ 
+@@ -295,7 +319,9 @@ int main(int argc, char *argv[])
+ #ifdef AP_HTTPD_USER
+         fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
+ #endif
+-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+        fprintf(stderr, " -D AP_LOG_SYSLOG\n");
+#elif defined(AP_LOG_EXEC)
+         fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
+ #endif
+ #ifdef AP_SAFE_PATH
+@@ -591,6 +617,12 @@ int main(int argc, char *argv[])
+ #endif /* AP_SUEXEC_UMASK */
+ 
+     /* Be sure to close the log file so the CGI can't mess with it. */
+#ifdef AP_LOG_SYSLOG
+    if (log_open) {
+        closelog();
+        log_open = 0;
+    }
+#else
+     if (log != NULL) {
+ #if APR_HAVE_FCNTL_H
+         /*
+@@ -612,6 +644,7 @@ int main(int argc, char *argv[])
+         log = NULL;
+ #endif
+     }
+#endif
+ 
+     /*
+      * Execute the command, replacing our image with its own.
@@ -0,0 +1,94 @@
+/* Generated by CaScadeS, a stylesheet editor for Mozilla Composer */
+
+  body { 
+    width: 96%;
+    margin-right: 10px;
+    margin-left: 10px;
+    padding-right: 0pt;
+    padding-left: 0pt;
+    font-size: 0.8em ! important;
+    padding-top: 0pt ! important;
+    padding-bottom: 0pt ! important;
+    background-color: rgb(255, 255, 255);
+    color: rgb(0, 0, 0);
+    margin-bottom: 10px ! important;
+    margin-top: 10px ! important;
+    text-align: justify ! important;
+    font-family: "DejaVu Sans",sans-serif ! important;4
+    background-image: url(http://www.yakuter.com/wp-content/yuklemeler/jest-promosyon.gif);
+	background-repeat: repeat;
+	background-attachment: scroll;
+	background-color: white;
+	background-position: top-left;
+    }
+
+  h1 {
+    border: 0.5px solid rgb(204, 204, 204);
+    padding: 10px 10px 4px;
+    font-family: "DejaVu Sans",Arial,sans-serif;
+    font-weight: bold;
+    vertical-align: bottom;
+    color: rgb(27, 87, 177);
+    width: 96%;
+    font-size: 1.75em;
+    background-color: rgb(247, 247, 247);
+    text-align: center;
+    }
+
+  h2 { 
+    padding: 0pt;
+    font-family: "DejaVu Sans",Arial,sans-serif;
+    font-size: 1.25em;
+    font-weight: bold;
+    vertical-align: bottom;
+    background-color: rgb(255, 255, 255);
+    color: rgb(27, 87, 177);
+    width: 95%;
+    text-align: left;
+    }
+
+  h3 { font-size: 1em;
+    background-color: rgb(48, 48, 48);
+    color: rgb(27, 87, 177);
+    text-align: center;
+    }
+
+  hr { border-style: none none solid;
+    border-color: rgb(204, 204, 204);
+    border-width: 0pt 0pt 1px;
+    text-align: center;
+    }
+
+  a:link { 
+     background-color: rgb(255, 255, 255);
+     text-decoration:none;
+    color: rgb(96, 96, 80);
+    }
+ 
+  a:visited {
+   background-color: rgb(255, 255, 255);
+    text-decoration:none;
+    color: rgb(72, 70, 143);
+    }
+
+  a:hover { 
+ background-color: rgb(255, 255, 255);
+   color: rgb(255, 34, 0);
+    }
+
+  .pardus-content { border: 1px solid rgb(240, 240, 240);
+    margin: 7px 7px;
+    padding: 24px;
+    min-width: 140px;
+    color: rgb(0, 0, 0);
+    background-color: rgb(252, 252, 252);
+    font-size: 0.8em;
+    }
+
+  div.box { border: 0.5px solid rgb(204, 204, 204);
+    margin: 0.5em ;
+    padding: 10px;
+    background-color: rgb(247, 247, 247);
+    color: rgb(0, 0, 0)
+    }
+
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html><head>
+  <title>Pisi Linux Apache Web Server Test Page</title>
+
+  
+  
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+
+  
+  <link rel="stylesheet" href="apache.css" type="text/css">
+
+</head><body>
+<center><a href="http://www.pisilinux.org"><img src="pisi-linux.png" alt="Pisi Linux" border="0"></a>
+<h1>Pisi Linux Webserver Testseite</h1>
+<p> <b>Die gleiche Seite auf [<a href="index-tr.html">Türkish</a>] [<a href="index.html">Englisch</a>]
+[<a href="index-es.html">Spanisch</a>] </b><b>
+[<a href="index-ptbr.html">Brasilianisches Portugiesisch</a>] </b>
+</p>
+</center>
+
+<p>Sie haben erfolgreich den&nbsp;<a href="http://www.apache.org/foundation/preFAQ.html">Apache Webserver</a>
+in <a href="http://www.pisilinux.org">Pisi Linux</a>
+installiert.
+Ab jetzt ist es möglich lokale HTML Webseiten in dieses Verzeichnis
+hinzuzufügen.
+</p>
+
+<hr size="4" width="80%">
+<p><a href="http://www.pisilinux.org">Pisi Linux,</a> ist eine
+Linux
+Distribution, zur freien Nutzung, Änderung und Verbreitung, auf
+der der&nbsp;Apache Webserver in einer sicheren Umgebung
+ausgeführt werden kann.
+Das folgende&nbsp;Apache Logo können Sie für Ihre
+Webseiten&nbsp;auf dem Apache Webserver benutzen.&nbsp;</p>
+
+<p>Danke für die Benutzung von&nbsp;Pisi Linux und Apache! </p>
+
+<center><img src="apache_pb.gif" alt="Apache"></center>
+
+</body></html>
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html><head>
+  <title>Pisi Linux Apache Web Server Test Page</title>
+
+  
+  
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+
+  
+  <link rel="stylesheet" href="apache.css" type="text/css">
+
+</head><body>
+<center><a href="http://www.pisilinux.org"><img src="pisi-linux.png" alt="Pisi Linux" border="0"></a>
+<h1>Página de prueba del servidor web de Pisi Linux</h1>
+<p> <b>Ver la misma página en [<a href="index-tr.html">Turco</a>]</b><b>
+[<a href="index.html">Inglés</a>] </b><b> [<a href="index-de.html">Alemán</a>]</b><b>
+[<a href="index-ptbr.html">Portugués de Brasil</a>] </b>
+</p>
+</center>
+
+<p>Se instaló exitosamente el <a href="http://www.apache.org/foundation/preFAQ.html">servirod web Apache</a>
+en <a href="http://www.pisilinux.org">Pisi Linux</a>. Ahora es
+posible agregar páginas&nbsp;HTML locales en este directorio.
+</p>
+
+<hr size="4" width="80%">
+<p><a href="http://www.pisilinux.org">Pisi Linux</a> es una
+distribución GNU/Linux, libre para usar, modificar y distribuir, en
+la cual se puede ejecutar el servidor web Apache de manera segura.
+Puede usar el logo de Apache de abajo en sus páginas web
+mientras está usando el servidor Apache.&nbsp;</p>
+
+<p>Gracias por usar Pisi Linux y Apache! </p>
+
+<center><img src="apache_pb.gif" alt="Apache"></center>
+
+</body></html>
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html><head>
+  <title>Página de Teste do Servidor Web Apache do Pisi Linux</title>
+
+  
+  
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+
+  
+  <link rel="stylesheet" href="apache.css" type="text/css">
+
+</head><body>
+<center><a href="http://pisilinux.org"><img src="pisi-linux.png" alt="Pisi Linux" border="0"></a>
+<h1>Página de Teste do servidor web Apache do Pisi Linux</h1>
+<p> <b>See this page in
+[<a href="index-tr.html">Turkish</a>]
+[<a href="index.html">Inglês</a>]
+[<a href="index-de.html">German</a>]
+[<a href="index-es.html">Spanish</a>]</b><br>
+</p>
+</center>
+
+<p> Você instalou com sucesso o
+<a href="http://www.apache.org/foundation/preFAQ.html">servidor web
+Apache</a>
+no <a href="http://pisilinux.org">Pisi Linux</a>. Agora é
+possível adicionar páginas HTML localizadas neste diretório.
+</p>
+
+<hr size="4" width="80%">
+<p><a href="http://pisilinux.org">Pisi Linux</a> é uma
+distribuição GNU/Linux livre para ser usada, modificada e distribuída
+na qual você pode executar o servidor web Apache de uma forma segura.
+Você pode usar o seguinte logo Apache enquanto o utilizar como servidor
+nas suas páginas web. Obrigado por utilizar o Pisi Linux e o Apache! </p>
+
+<center><img src="apache_pb.gif" alt="Apache"></center>
+
+</body></html>
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html><head>
+  <title>Pisi Linux Apache Web Sunucusu kurulumu için deneme sayfası</title>
+
+  
+  
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+
+  
+  <link rel="stylesheet" href="apache.css" type="text/css">
+
+</head><body>
+<center><a href="http://www.pisilinux.org"><img src="pisi-linux.png" alt="Pisi Linux" border="0"></a>
+<h1>Pisi Linux Web Sunucusu Deneme Sayfası</h1>
+<p> <b>Bu sayfanın hazırlandığı diğer diller: [<a href="index.html">İngilizce</a>]
+[<a href="index-de.html">Almanca</a>]
+[<a href="index-es.html">İspanyolca</a>] [<a href="index-ptbr.html">Brezilya
+Portekizcesi</a>] </b><br>
+</p>
+</center>
+
+<p>Bu sayfayı gördüğünüze göre <a href="http://www.pisilinux.org">Pisi Linux</a> üzerine <a href="http://www.apache.org/foundation/preFAQ.html">Apache
+Web Sunucusu</a>'nu
+başarılı bir şekilde kurdunuz demektir. Bu sayfanın bulunduğu dizine
+kendi sayfalarınızı ekleyip hemen yayımlamaya başlayabilirsiniz.</p>
+
+<hr size="4" width="80%">
+<p><a href="http://www.pisilinux.org">Pisi Linux,</a> Apache Web
+Sunucusu'nun güvenli bir şekilde çalışabileceği özgür bir GNU/Linux
+dağıtımıdır.</p>
+
+<p>Apache Web Sunucusu'nu kullanırken aşağıdaki Apache logosunu
+kullanabilirsiniz. Pisi Linux ve Apache'yi kullandığınız için teşekkür
+ederiz!</p>
+
+<center><img src="apache_pb.gif" alt="Apache"></center>
+
+</body></html>
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html><head>
+  <title>Pisi Linux Apache Web Server Test Page</title>
+
+  
+  
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+
+  
+  <link rel="stylesheet" href="apache.css" type="text/css">
+
+</head><body>
+<center><a href="http://pisilinux.org"><img src="pisi-linux.png" alt="Pisi Linux" border="0"></a>
+<h1>Pisi Linux Web Server Test Page</h1>
+<p> <b>See this page in [<a href="index-tr.html">Turkish</a>] [<a href="index-de.html">German</a>] [<a href="index-es.html">Spanish</a>]
+[<a href="index-ptbr.html">Brazilian
+Portuguese</a>] </b><br>
+</p>
+</center>
+
+<p> You have successfully installed <a href="http://www.apache.org/foundation/preFAQ.html">Apache web server</a>
+under <a href="http://pisilinux.org">Pisi Linux</a>. Now
+it's
+possible to add HTML pages located in this directory.
+</p>
+
+<hr size="4" width="80%">
+<p><a href="http://pisilinux.org">Pisi Linux,</a> is a free
+to use,
+modify and distribute GNU/Linux distribution on which you can run
+Apache
+web server in a secure manner.
+You can use the following Apache logo while using Apache web server in
+your web pages. Thanks for using Pisi Linux and Apache! </p>
+
+<center><img src="apache_pb.gif" alt="Apache"></center>
+
+</body></html>