Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to get a chrooted Apache environment working running mod_fcgid with suexec.

Looking at suexec log inside jail, the wrapper scripts are being executed with no problems, however, when I look at Apache's error log I'm seeing the errors below;

suexec failure: could not open log file
fopen: Permission denied

suexec.log;

[2013-06-20 01:15:39]: uid: (500/user) gid: (500/user) cmd: php-fcgi-starter
[2013-06-20 01:16:30]: uid: (500/user) gid: (500/user) cmd: php-fcgi-starter
[2013-06-20 01:16:39]: uid: (500/user) gid: (500/user) cmd: php-fcgi-starter
[2013-06-20 01:18:07]: uid: (500/user) gid: (500/user) cmd: php-fcgi-starter
[2013-06-20 01:22:21]: uid: (500/user) gid: (500/user) cmd: php-fcgi-starter

When I strace both php and suexec, they do not complain about any missing library or file. The log says "could not open log file" but it obviously logs into the error log file inside the jail. What's wrong with this setup? What may trigger this error?

edit :

strace results;

[pid  9912] rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_INTERRUPT, 0x7fca687fe500}, {SIG_DFL, [], 0}, 8) = 0
[pid  9912] chdir("/var/www/username/cgi-bin/") = 0
[pid  9912] execve("/usr/sbin/suexec", ["/usr/sbin/suexec", "500", "500", "php-fcgi-starter"], [/* 1 var */]) = 0
[pid  9912] brk(0)                      = 0x7f2d71e91000
[pid  9912] fcntl(0, F_GETFD)           = 0
[pid  9912] fcntl(1, F_GETFD)           = 0
[pid  9912] fcntl(2, F_GETFD)           = 0
[pid  9912] access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f2000
[pid  9912] access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid  9912] open("/etc/ld.so.cache", O_RDONLY) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=13704, ...}) = 0
[pid  9912] mmap(NULL, 13704, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f2d715ee000
[pid  9912] close(3)                    = 0
[pid  9912] open("/lib64/libc.so.6", O_RDONLY) = 3
[pid  9912] read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\355\1\0\0\0\0\0"..., 832) = 832
[pid  9912] fstat(3, {st_mode=S_IFREG|0755, st_size=1916568, ...}) = 0
[pid  9912] mmap(NULL, 3745960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f2d71041000
[pid  9912] mprotect(0x7f2d711cb000, 2093056, PROT_NONE) = 0
[pid  9912] mmap(0x7f2d713ca000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x189000) = 0x7f2d713ca000
[pid  9912] mmap(0x7f2d713cf000, 18600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2d713cf000
[pid  9912] close(3)                    = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f9000
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715ed000
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715ec000
[pid  9912] arch_prctl(ARCH_SET_FS, 0x7f2d715ed700) = 0
[pid  9912] mprotect(0x7f2d713ca000, 16384, PROT_READ) = 0
[pid  9912] mprotect(0x7f2d715f3000, 4096, PROT_READ) = 0
[pid  9912] munmap(0x7f2d715ee000, 13704) = 0
[pid  9912] brk(0)                      = 0x7f2d71e91000
[pid  9912] brk(0x7f2d71eb2000)         = 0x7f2d71eb2000
[pid  9912] getuid()                    = 48
[pid  9912] socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
[pid  9912] connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid  9912] close(3)                    = 0
[pid  9912] socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
[pid  9912] connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid  9912] close(3)                    = 0
[pid  9912] open("/etc/nsswitch.conf", O_RDONLY) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=1688, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f1000
[pid  9912] read(3, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1688
[pid  9912] read(3, "", 4096)           = 0
[pid  9912] close(3)                    = 0
[pid  9912] munmap(0x7f2d715f1000, 4096) = 0
[pid  9912] open("/etc/ld.so.cache", O_RDONLY) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=13704, ...}) = 0
[pid  9912] mmap(NULL, 13704, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f2d715ee000
[pid  9912] close(3)                    = 0
[pid  9912] open("/lib64/libnss_files.so.2", O_RDONLY) = 3
[pid  9912] read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0"..., 832) = 832
[pid  9912] fstat(3, {st_mode=S_IFREG|0755, st_size=65928, ...}) = 0
[pid  9912] mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f2d70e33000
[pid  9912] mprotect(0x7f2d70e3f000, 2097152, PROT_NONE) = 0
[pid  9912] mmap(0x7f2d7103f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc000) = 0x7f2d7103f000
[pid  9912] close(3)                    = 0
[pid  9912] mprotect(0x7f2d7103f000, 4096, PROT_READ) = 0
[pid  9912] munmap(0x7f2d715ee000, 13704) = 0
[pid  9912] open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
[pid  9912] fcntl(3, F_GETFD)           = 0x1 (flags FD_CLOEXEC)
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=952, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f1000
[pid  9912] read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 952
[pid  9912] close(3)                    = 0
[pid  9912] munmap(0x7f2d715f1000, 4096) = 0
[pid  9912] open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=952, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f1000
[pid  9912] read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 952
[pid  9912] close(3)                    = 0
[pid  9912] munmap(0x7f2d715f1000, 4096) = 0
[pid  9912] socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
[pid  9912] connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid  9912] close(3)                    = 0
[pid  9912] socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
[pid  9912] connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid  9912] close(3)                    = 0
[pid  9912] open("/etc/group", O_RDONLY|O_CLOEXEC) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=520, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f1000
[pid  9912] read(3, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 520
[pid  9912] close(3)                    = 0
[pid  9912] munmap(0x7f2d715f1000, 4096) = 0
[pid  9912] open("/var/log/httpd/suexec.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=17043, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f1000
[pid  9912] fstat(3, {st_mode=S_IFREG|0644, st_size=17043, ...}) = 0
[pid  9912] lseek(3, 17043, SEEK_SET)   = 17043
[pid  9912] gettimeofday({1371690955, 897472}, NULL) = 0
[pid  9912] open("/etc/localtime", O_RDONLY) = 4
[pid  9912] fstat(4, {st_mode=S_IFREG|0644, st_size=2102, ...}) = 0
[pid  9912] fstat(4, {st_mode=S_IFREG|0644, st_size=2102, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f0000
[pid  9912] read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0"..., 4096) = 2102
[pid  9912] lseek(4, -1337, SEEK_CUR)   = 765
[pid  9912] read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0"..., 4096) = 1337
[pid  9912] close(4)                    = 0
[pid  9912] munmap(0x7f2d715f0000, 4096) = 0
[pid  9912] write(3, "[2013-06-20 03:15:55]: uid: (500"..., 77) = 77
[pid  9912] setgid(500)                 = 0
[pid  9912] open("/proc/sys/kernel/ngroups_max", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid  9912] open("/etc/group", O_RDONLY|O_CLOEXEC) = 4
[pid  9912] fstat(4, {st_mode=S_IFREG|0644, st_size=520, ...}) = 0
[pid  9912] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2d715f0000
[pid  9912] lseek(4, 0, SEEK_CUR)       = 0
[pid  9912] read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 520
[pid  9912] read(4, "", 4096)           = 0
[pid  9912] close(4)                    = 0
[pid  9912] munmap(0x7f2d715f0000, 4096) = 0
[pid  9912] setgroups(1, [500])         = 0
[pid  9912] setuid(500)                 = 0
[pid  9912] getcwd("/var/www/username/cgi-bin", 4096) = 22
[pid  9912] chdir("/var/www")           = 0
[pid  9912] getcwd("/var/www", 4096)    = 9
[pid  9912] chdir("/var/www/username/cgi-bin") = 0
[pid  9912] lstat("/var/www/username/cgi-bin", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
[pid  9912] lstat("php-fcgi-starter", {st_mode=S_IFREG|0755, st_size=128, ...}) = 0
[pid  9912] close(3)                    = 0
[pid  9912] munmap(0x7f2d715f1000, 4096) = 0
[pid  9912] execve("php-fcgi-starter", ["php-fcgi-starter"], [/* 1 var */]) = -1 ENOENT (No such file or directory)
[pid  9912] open("/var/log/httpd/suexec.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = -1 EACCES (Permission denied)
[pid  9912] write(2, "suexec failure: could not open l"..., 40) = 40
[pid  9912] write(2, "fopen: Permission denied\n", 25) = 25
[pid  9912] exit_group(1)               = ?

the last ~20 lines is where the server throws the error.

share|improve this question
add comment

1 Answer

This looks like a permissions problem. Specifically I believe SUExec requires that the directory /var/www/html and /var/www/cgi-bin/php5/php-fcgi-starter be owned by the same user.

I'd make sure they're both owned by uid: 500 and gid: 500, or whatever user you're particular system/setup is geared to using.

share|improve this answer
    
everything looks fine in terms of ownerships. both public directory and wrapper script along with their parent folders are owned by the same users. I've added strace results to my message. –  compixtr Jun 20 '13 at 7:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.