Passenger/mod_rails fails to initialize in Fedora

问题:

I am in the process of setting up a server to run a Ruby on Rails application on Fedora 12, using Passenger.

I am at the stage where I've installed Passenger, set it up as prescribed, but get the following errors when I restart Apache:

[Wed Jan 13 15:41:38 2010] [notice] caught SIGTERM, shutting down
[Wed Jan 13 15:41:40 2010] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Wed Jan 13 15:41:40 2010] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Jan 13 15:41:40 2010] [error] *** Passenger could not be initialized because of this error: Cannot create FIFO file /tmp/passenger.25235/.guard: Permission denied (13)
[Wed Jan 13 15:41:40 2010] [notice] Digest: generating secret for digest authentication ...
[Wed Jan 13 15:41:40 2010] [notice] Digest: done
[Wed Jan 13 15:41:40 2010] [error] *** Passenger could not be initialized because of this error: Cannot create FIFO file /tmp/passenger.25235/.guard: Permission denied (13)
[Wed Jan 13 15:41:40 2010] [error] python_init: Python version mismatch, expected '2.6', found '2.6.2'.
[Wed Jan 13 15:41:40 2010] [error] python_init: Python executable found '/usr/bin/python'.
[Wed Jan 13 15:41:40 2010] [error] python_init: Python path being used '/usr/lib/python26.zip:/usr/lib/python2.6/:/usr/lib/python2.6/plat-linux2:/usr/lib/python2.6/lib-tk:/usr/lib/python2.6/lib-old:/usr/lib/python2.6/lib-dynload'.
[Wed Jan 13 15:41:40 2010] [notice] mod_python: Creating 4 session mutexes based on 256 max processes and 0 max threads.
[Wed Jan 13 15:41:40 2010] [notice] mod_python: using mutex_directory /tmp 
[Wed Jan 13 15:41:40 2010] [notice] Apache/2.2.14 (Unix) DAV/2 Phusion_Passenger/2.2.9 PHP/5.3.0 mod_python/3.3.1 Python/2.6.2 mod_ssl/2.2.14 OpenSSL/1.0.0-fips-beta3 mod_perl/2.0.4 Perl/v5.10.0 configured -- resuming normal operations

As you can see, there is a permissions problem when Passenger is trying to initialize:

[Wed Jan 13 15:41:40 2010] [error] *** Passenger could not be initialized because of this error: Cannot create FIFO file /tmp/passenger.25235/.guard: Permission denied (13)

When Apache is starts, it does create a file in /tmp:

d-ws--x--x. 2 root  root  4096 2010-01-13 16:04 passenger.26117

If instead I run the app by firing up mongrel directly with mongrel_rails start -e production, I see the following:

ActiveRecord::StatementInvalid (Mysql::Error: Can't create/write to file '/tmp/#sql_5d3_0.MYI' (Errcode: 13): SHOW FIELDS FROM `users`):

Again the error points to permission issues with the /tmp directory.

I am at a loss as to what the solution is. I'm not sure if it is related to simply directory permissions or Fedora's SELinux security.

Any help would be appreciated. Thanks.

回答1:

I did the same as Fred, except that instead of doing it one error at a time:

1. Go into permissive mode by running setenforce 0
2. Restart apache, and hit your site and use it for a while as normal
3. Run grep httpd /var/log/audit/audit.log | audit2allow -M passenger
4. semodule -i passenger.pp
5. Go back to enforcing mode by running setenforce 1
6. Restart apache and test your site - hopefully it should all be working as before!

Note that this is basically a specific example of the procedure on the Centos SELinux help - check it out.

回答2:

I'm having the same issue in CentOS 5.4, SELinux getting in the way of Passenger.

Setting PassengerTempDir to /var/run/passenger simply gives you the same permission errors in the new directory instead of /tmp :

[Mon Feb 22 11:42:40 2010] [error] *** Passenger could not be initialized because of this error: Cannot create directory '/var/run/passenger/passenger.3686'

I can then change the security context of /var/run/passenger to get past this error:

chcon -R -h -t httpd_sys_content_t /var/run/passenger/

...and that lets Passenger create the temp directory, but not files within that directory:

[Mon Feb 22 12:07:06 2010] [error] *** Passenger could not be initialized because of this error: Cannot create FIFO file /var/run/passenger/passenger.3686/.guard: Permission denied (13)

Oddly, re-running the recursive chcon again doesn't get past this error, it keeps dying at this point, and this is where my SELinux knowledge gets murky.

The Phusion Passenger guide sections 6.3.5 and 6.3.7 have some useful thoughts, but they don't seem to completely resolve the problem.

回答3:

You need more than just the httpd_sys_content_t permission. I use the following technique to get things started:

• start a tail on the audit log: tail -f /var/log/audit/audit.log
• reload apache: apachectl restart
• Go to the /tmp/directory: cd /tmp
• If just 1 line is added use the command: tail -1 /var/log/audit/audit.log | audit2allow -M httpdfifo
• Note that the name 'httpdfifo' is just a name chosen to reflect the kind of error that has been observed.
• This will create a file named 'httpdfifo.pp'. To allow apache to create a FIFO from here on after you have to issue the command: semodule -i httpdfifo.pp
• Continue to do this until all audit errors have been resolved (It took 4 different kind of permissions on my system running Centos 5.4)

回答4:

Running setenforce 0 before starting will let you test if it's SELinux. Don't forget to run setenforce 1 afterwards.

回答5:

I tried what Dan Sketcher and Fred Appleman suggested, i.e. repeat the following:

yum install setroubleshoot
echo > /var/log/audit/audit.log # clear irrelevant errors
cd ~
service httpd restart # try booting passenger -- audit.log now shows the relevant permission errors
tail -f /var/log/httpd/error_log # check that passenger is still failing due to permission errors
sealert -a /var/log/audit/audit.log > selinux-diag.txt # translate the permission errors
# read and check that you are happy with selinux-diag.txt 
# and either follow its specific advice, or if it just wants you to grep into audit2allow, then:
cat /var/log/audit/audit.log | audit2allow -M mypol  # grant everything just denied
semodule -i mypol.p # commit new permissions

But after doing this 5 or 6 times, I kept coming up against new errors, and some of the same errors came up even after I had tried to permit them with "audit2allow".

In the end I just turned off SELinux, with:

echo 0 >/selinux/enforce