Asp Forum - fastcgi permission error

Carl Youngblood

9/30/2003 7:25:00 AM

Hello, I'm trying to set up ruby-fastcgi on redhat 9. Everything seems
to be set up right, but I get an error in my apache logs when I try to
access a simple fcgi ruby script:

[Tue Sep 30 01:15:54 2003] [alert] [client 127.0.0.1] (13)Permission
denied: FastCGI: failed to connect to (dynamic) server
"/var/www/cgi-bin/test.fcgi": something is seriously wrong, any chance
the socket/named_pipe directory was removed?, see the FastCgiIpcDir
directive

A while back I was able to set up ruby-fcgi on a gentoo installation of
linux without ever running into this problem. Does anybody have any
ideas about what might be wrong?

Thanks,
Carl Youngblood

P.S. In case it's helpful, here is the sample script I'm trying to run:

#!/usr/local/bin/ruby
require 'cgi'
require 'fcgi'

FCGI.each_cgi do |cgi|
content = ''
env = []
cgi.env_table.each do |k,v|
env << [k,v]
end
env.sort!
env.each do |k,v|
content << %Q(#{k} => #{v}<br>\n)
end
cgi.out{content}
end

7 Answers

ahoward

9/30/2003 2:24:00 PM

Carl Youngblood

9/30/2003 5:19:00 PM

Carl Youngblood

9/30/2003 5:36:00 PM

> so, when any program runs that requires ''fcgi.so'', it, in turn, will cause the
> linker to look for all the other libs it needs. sometimes the paths will be
> incomplete and the linker will need to look for the others in LD_LIBRARY_PATH
> or /etc/ld.so.conf. it can happen (it has to me) that a module _you_ require
> works completely find because the directory of the libs _it_ depends on are in
> your LD_LIBRARY_PATH and ld.so can find them. however, when you are running a
> cgi it is user nobody that is running the script and his LD_LIBRARY_PATH may
> not have a path where the depending lib can be found. i think i saw this with
> the postgres module before... any how, you can fix it by configuring ld.so
> (/etc/ld.so.conf) _or_ by compiling with LD_RUN_PATH set, which hard codes the
> paths into the shared module. or by setting the global LD_LIBRARY_PATH but i
> forget how to do that.

Okay, so I updated /etc/ls.so.conf and even figured out that I needed to
run /sbin/ldconfig in order to update my changes. I also restarted the
httpd daemon just to make sure that it got those changes as well.
However, I''m still seeing the problem:

> [Tue Sep 30 11:26:21 2003] [crit] (13)Permission denied: FastCGI: can''t create (dynamic) server "/var/www/cgi-bin/test.fcgi": bind() failed [/etc/httpd/logs/fastcgi/dynamic/35830e69d0669b031643022d74f2d729]
> [Tue Sep 30 11:26:26 2003] [alert] [client 127.0.0.1] (13)Permission denied: FastCGI: failed to connect to (dynamic) server "/var/www/cgi-bin/test.fcgi": something is seriously wrong, any chance the socket/named_pipe directory was removed?, see the FastCgiIpcDir directive

It may be, as you said, that the web server user (apparently redhat sets
up a user called apache for the web server to run as) can''t see the
same library path that I can. However, I can''t check since when run:

sudo su apache -c ''/var/www/cgi-bin/test.fcgi < /dev/null''

It says "This account currently is not available." What''s more, even
though my user could not see /usr/local/lib in its library path, it was
able to run the fcgi script from the command line, since ruby-fcgi seems
to bypass fcgi.so when it is running from the command line.

So, I think I am closer but there is still a problem.

Thanks,
Carl

Aria Stewart

9/30/2003 5:49:00 PM

> libfcgi.so.0 is in /usr/local/lib. I added /usr/local/lib to
> /etc/ld.so.conf, but I''m still seeing the same problem. I''m assuming
> that it''s just because editing the file doesn''t update my environment
> automatically. The thing is, I''m trying to write a shell script that
> will take a default redhat installation and setup apache with ruby-fcgi
> so I would like to know how to get my system to dynamically update my
> changes to /etc/ld.so.conf.

Run "ldconfig"

Ari

ahoward

9/30/2003 5:57:00 PM

Carl Youngblood

9/30/2003 6:39:00 PM

>
>
>o.k. - assuming it IS a linker problem
>
><straw_grasping>
>
>i have seen this before - but don''t know a work around. you probably can''t
> sudo su apache
>then
> /var/www/cgi-bin/test.fcgi < /dev/null
>either?
>
>
No, it won''t let me do that either.

>other thoughts (debug hacks):
>
> * set LD_LIBRARY_PATH in your cgi program BEFORE requiring any libs
>
> ENV[''LD_LIBRARY_PATH''] = path_to_fcgi_libs
>
> * set
>
> ENV[''LD_DEBUG''] = ''all''
> ENV[''LD_DEBUG_OUTPUT''] = ''./ld_debug_output''
>
> (man ld.so)
>
> and try again. this should produce a file ''ld_debug_output'' in the same
> directory as the fcgi program that tells you what loaded/did not load.
>
> BE SURE TO HAVE THE FGI PROGRAM AND IT''S DIRECTORY 777 - JUST TO BE SURE.
>
></straw_grasping>
>
This didn''t seem to make any difference. FYI, LD_LIBRARY_PATH isn''t set
in my environment before I set it.

Carl

Carl Youngblood

9/30/2003 10:47:00 PM

Wow. Thanks a lot for taking time to work on this. I had tried setting
the ipc dir last night, and I even read the manual :) but got error
messages during apache startup, so I took it out. The weird thing is,
unless I chmod the logs/fastcgi directory to 777, the server can''t
access it, even though the server is supposed to be running as apache
and the directory is owned by apache. The error message it was giving
me was:

Syntax error on line 223 of /etc/httpd/conf/httpd.conf:
FastCgiIpcDir /etc/httpd/logs/fastcgi: access for server (uid -1, gid
-1) failed: write not allowed

When I recursively chmod it to 777, I stop getting the error message on
Apache startup, but I wanted a less kludgy solution. I found that the
problem was because httpd.conf was setting the apache user later on in
my conf file. After I moved the user and group settings to the top of
the conf file, the error on startup went away without having to 777 the
fastcgi log dir.

However, I was still getting the 500 error, even after following all of
your suggestions. It appears that the error is related somehow to this
directory, because my error log says:

[Tue Sep 30 16:18:40 2003] [crit] (13)Permission denied: FastCGI: can''t
create (dynamic) server "/var/www/cgi-bin/test.fcgi": bind() failed
[/etc/httpd/logs/fastcgi/dynamic/35830e69d0669b031643022d74f2d729]
[Tue Sep 30 16:18:44 2003] [alert] [client 127.0.0.1] (13)Permission
denied: FastCGI: failed
to connect to (dynamic) server "/var/www/cgi-bin/test.fcgi": something
is seriously wrong, any chance the socket/named_pipe directory was
removed?, see the FastCgiIpcDir directive

As if it is trying to create some temporary file in this directory and
is failing. The problem is that even when it is 777 it still seems to
fail. Adding the ENV statement in the fcgi script didn''t seem to do
anything.

So I went out to the web to look for this particular error and I found a
posting about someone who had the same problem with red hat 8 here:
http://www.fastcgi.com/archives/fastcgi-developers/2002-December/0...

He said that since the server root is in /etc/httpd and that
/etc/httpd/logs is really a symlink to /var/log/httpd, fastcgi is having
permission problems. The solution is to get rid of the /etc/httpd/logs
symlink and make it a real directory instead, copying all the old log
files from /var/log/httpd into the new directory. Then just
leave FastCgiIpcDir the same or even get rid of it and it will work
fine. I guess fastcgi doesn''t work well with symlinks.

Even weirder was the fact that setting FastCgiIpcDir to
/var/log/httpd/fastcgi also didn''t work--just the fact that apache was
symlinking to the same dir caused it not to like it. However, when I
changed FastCgiIpcDir to some other full path, such as /tmp, it worked
just fine.

Anyway, I think the best solution to the problem is to get rid of the
logs symlink in /etc/httpd and change it to a real directory.

Thanks again for all your help.

Carl

comp.lang.ruby

fastcgi permission error

Carl Youngblood

ahoward

Carl Youngblood

Carl Youngblood

Aria Stewart

ahoward

Carl Youngblood

Carl Youngblood

x Login to ForumsZone