From: Joe Orton <jorton@apache.org>
Date: Wed, 19 Feb 2020 10:52:38 +0000 (+0000)
Subject: Warn against using "nobody" for User/Group since it's bad practice.
X-Git-Tag: 2.5.0-alpha2-ci-test-only~1639
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd5e57152a406699d91d61508ba0e8e753334888;p=thirdparty%2Fapache%2Fhttpd.git

Warn against using "nobody" for User/Group since it's bad practice.
Add note on supplementary groups. [skip ci]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874187 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/mod_unixd.xml b/docs/manual/mod/mod_unixd.xml
index 0c9dd6e930b..656f38a1ac9 100644
--- a/docs/manual/mod/mod_unixd.xml
+++ b/docs/manual/mod/mod_unixd.xml
@@ -61,13 +61,16 @@ requests</description>
     </example>
 
     <p>It is recommended that you set up a new group specifically for
-    running the server. Some admins use user <code>nobody</code>,
-    but this is not always possible or desirable.</p>
+    running the server.  If the configured <directive>User</directive>
+    is a member of any supplementary groups, the process will also
+    become a member of these groups.</p>
 
     <note type="warning"><title>Security</title>
       <p>Don't set <directive>Group</directive> (or <directive
       module="mod_unixd">User</directive>) to <code>root</code> unless
-      you know exactly what you are doing, and what the dangers are.</p>
+      you know exactly what you are doing, and what the dangers are.
+      It is not recommended to use the group <code>nobody</code>,
+      which is not intended for use by long-running daemons.</p>
     </note>
 
 </usage>
@@ -106,14 +109,14 @@ requests</description>
     outside world, and similarly, the user should not be able to
     execute code that is not meant for HTTP requests. It is
     recommended that you set up a new user and group specifically for
-    running the server. Some admins use user <code>nobody</code>, but
-    this is not always desirable, since the <code>nobody</code> user
-    can have other uses on the system.</p>
+    running the server.</p>
 
     <note type="warning"><title>Security</title>
       <p>Don't set <directive>User</directive> (or <directive
       module="mod_unixd">Group</directive>) to <code>root</code> unless
-      you know exactly what you are doing, and what the dangers are.</p>
+      you know exactly what you are doing, and what the dangers are.
+      It is not recommended to use the user <code>nobody</code>,
+      which is not intended for use by long-running daemons.</p>
     </note>
 
 </usage>