Re: [9front] httpd minimal configuration

[Jacob Moody <moody@mail.posixcafe.org>]

On 6/21/22 06:58, planless.user9 wrote:
> Thank you very much for your fast and helpful reply.
> 
> I will look at the source code in that case, hoping to get a simple web server set up.
> 
> Are there concrete insecurities in the implementation of namespaces?
> 

Some thoughts:
First off you seemed to imply that rc-httpd had to be used with werc, this is not the case.
If your goal is to just serve some static files rc-httpd on its own is more then capable. I would be
curious to hear your reasoning for preferring httpd.

Hiro claims that namespaces are not security boundaries. I think I would agree
maybe 6 months ago, but some work has been done lately to change this.
I'd argue that with chdev and auth/box we're in a much much nicer spot
in regards to making namespaces proper security boundaries, if you still disagree
with this statement I would be curious to hear what you think still needs changed.

Also you mention /lib/namespace.httpd, it _is_ expected that you customize it for your
system, modify it to place your webroot in the right spot.

However if you are using rc-httpd with aux/listen, there is a namespace file already
that takes advantage of newer security features: /rc/bin/service/!tcp80.namespace.
If you would wish to use this, cp /rc/bin/!tcp80 /rc/bin/tcp80 and cp /rc/bin/!tcp80.namespace
/rc/bin/tcp80.namespace, then customize as desired.

If you need some tips on writing/reading namespace files, check namespace(6), and the associated
(1) pages for commands mirrored in namespace files.

Thanks,
moody