Hi,

While upgrading apache2 on several hosts, we noticed regressions on
some vhost option handling.

One vhost contained:

	AllowOverride FileInfo Options=+SymLinksIfOwnerMatch

Another one contained:

	AllowOverride AuthConfig Limit FileInfo Indexes Options=FilterDeclare

Both servers failed to reload their configuration after apache2 upgrade
because of the following failures.

Regards,

taffit

Le lundi 25 août 2025 09:35:17 heure d’été d’Europe centrale, vous avez écrit :
Peux tu m'envoyer un minimal from scratch test case ?

C'est upstream la et il faut que je fasse un rapport qui sera public.

Je mettrai su salsa autopkgtest à l'avenir

Bastien

Hi Bastien,

Thankrs for your prompt reply.

root@test-www01:~# cat /etc/apache2/sites-enabled/examplenet.conf
<VirtualHost *:80 *:443>
    ServerName example.net
    DocumentRoot /home/examplenet/www/

    <Directory /home/examplenet/www/>
        Options +SymLinksIfOwnerMatch
        AllowOverride AuthConfig Limit FileInfo Options=+SymLinksIfOwnerMatch Options=FilterDeclare
        Require all granted
    </Directory>
</VirtualHost>

root@test-www01:~# apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
Use 'apt autoremove' to remove it.
The following packages will be upgraded:
  apache2 apache2-bin apache2-data apache2-utils
4 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/2,194 kB of archives.
After this operation, 49.2 kB of additional disk space will be used.
Do you want to continue? [Y/n]
(Reading database ... 71457 files and directories currently installed.)
Preparing to unpack .../apache2_2.4.65-1~deb11u1_amd64.deb ...
Unpacking apache2 (2.4.65-1~deb11u1) over (2.4.62-1~deb11u2) ...
Preparing to unpack .../apache2-bin_2.4.65-1~deb11u1_amd64.deb ...
Unpacking apache2-bin (2.4.65-1~deb11u1) over (2.4.62-1~deb11u2) ...
Preparing to unpack .../apache2-data_2.4.65-1~deb11u1_all.deb ...
Unpacking apache2-data (2.4.65-1~deb11u1) over (2.4.62-1~deb11u2) ...
Preparing to unpack .../apache2-utils_2.4.65-1~deb11u1_amd64.deb ...
Unpacking apache2-utils (2.4.65-1~deb11u1) over (2.4.62-1~deb11u2) ...
Setting up apache2-bin (2.4.65-1~deb11u1) ...
Setting up apache2-data (2.4.65-1~deb11u1) ...
Setting up apache2-utils (2.4.65-1~deb11u1) ...
Setting up apache2 (2.4.65-1~deb11u1) ...
Job for apache2.service failed because the control process exited with error code.
See "systemctl status apache2.service" and "journalctl -xe" for details.
apache-htcacheclean.service is a disabled or a static unit not running, not starting it.
Processing triggers for man-db (2.9.4-2) ...
mount: /usr: mount point is busy.
root@test-www01:~# apachectl configtest
AH00526: Syntax error on line 7 of /etc/apache2/sites-enabled/examplenet.conf:
Illegal option +SymLinksIfOwnerMatch
Action 'configtest' failed.
The Apache error log may have more information.
root@test-www01:~# vi /etc/apache2/sites-enabled/examplenet.conf # Retrait de Options=+SymLinksIfOwnerMatch
root@test-www01:~# apachectl configtest
AH00526: Syntax error on line 7 of /etc/apache2/sites-enabled/examplenet.conf:
Illegal option FilterDeclare
Action 'configtest' failed.
The Apache error log may have more information.

Cheers,

Le lundi 25 août 2025, 10:44:33 heure d’été d’Europe centrale David Prevot a écrit :
Hi David

Could check if reverting this changes fix your problem ?
https://github.com/apache/httpd/pull/310/commits/7c52fae8fb0234089cfb61a1c63d7701c2d2b97a

I can when salsa CI is up do a revert if need using aptly target

Main problem is that it seems your config is silently ignored, could you test on your side ?

rouca

Le lundi 25 août 2025, 17:11:42 heure d’été d’Europe centrale Bastien Roucaries a écrit :
Could you also try without patch

AllowOverride AuthConfig Limit FileInfo
AllowOverrideList Options=SymLinksIfOwnerMatch Options=FilterDeclare

It seems that correct syntaxt according to documentation was
AllowOverride Options=Indexes,MultiViews

rouca

Hi,

Thanks for the input. I can confirm that both the patched version, and
the current bullseye-security version with the configuration change you
proposed are working (on my test instance).

I have not checked if these options have been working lately, if they
were no-op for a while or just not needed (on the actual servers they
were used). I don’t know yet when or how I’ll manage to figure this out,
so feel free to close this bug report in the mean time (since it can be
considered as an admin mistake to use AllowOverride instead of
AllowOverrideList).

Thanks a lot for your detailed and prompt answers!

Regards,

Le mardi 26 août 2025, 09:53:39 heure d’été d’Europe centrale David Prevot a écrit :

Agreed, thanks to you

rouca