You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Óscar Frías Barranco <of...@gmail.com> on 2011/11/28 14:14:48 UTC
Problem starting Tomcat + APR on port 80 using jsvc with setuid
Hi.
I want to start Tomcat 6.0.33 (running on port 80) from the command line of
a non-root user. I have set the setuid flag in the jsvc binary to
"convert" the non-root user to root at the time of execution. Then the
jsvc binary is executed with the "--user tomcat" parameter.
The thing is that the whole setup works and I can successfully start Tomcat
from a non-root user command line if I don't use APR (libtcnative-1).
But then I installed APR and now I can only start Tomcat from root command
line. If I try to start Tomcat from the non-root user command line I get
the exception at the bottom.
Why is this happening? Is this a Tomcat bug? Do I have to setuid another
file besides "jsvc"? Thanks!
INFO: JvmRouteBinderValve started
Nov 28, 2011 1:28:25 PM org.apache.coyote.http11.Http11AprProtocol start
SEVERE: Error starting endpoint
java.lang.Exception: Socket bind failed: [13] Permission denied
at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:649)
at
org.apache.tomcat.util.net.AprEndpoint.start(AprEndpoint.java:766)
at
org.apache.coyote.http11.Http11AprProtocol.start(Http11AprProtocol.java:137)
at
org.apache.catalina.connector.Connector.start(Connector.java:1095)
at
org.apache.catalina.core.StandardService.start(StandardService.java:540)
at
org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:243)
Nov 28, 2011 1:28:25 PM org.apache.catalina.core.StandardService start
SEVERE: Failed to start connector [Connector[HTTP/1.1-80]]
LifecycleException: service.getName(): "Catalina"; Protocol handler start
failed: java.lang.Exception: Socket bind failed: [13] Permission denied
at
org.apache.catalina.connector.Connector.start(Connector.java:1102)
at
org.apache.catalina.core.StandardService.start(StandardService.java:540)
at
org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:243)
Nov 28, 2011 1:28:25 PM org.apache.catalina.startup.Catalina start
INFO: Server startup in 4120 ms
Óscar
Re: Problem starting Tomcat + APR on port 80 using jsvc with setuid
Posted by Óscar Frías Barranco <of...@gmail.com>.
Thanks for your replies.
At the end I include the logs from the beginning.
(by the way, I cannot use "sudo" because I would like to restart tomcat
from a non-interactive script)
Nov 28, 2011 2:41:41 PM org.apache.catalina.core.AprLifecycleListener init
INFO: Loaded APR based Apache Tomcat Native library 1.1.20.
Nov 28, 2011 2:41:41 PM org.apache.catalina.core.AprLifecycleListener init
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters
[false], random [true].
Nov 28, 2011 2:41:41 PM org.apache.coyote.http11.Http11AprProtocol init
SEVERE: Error initializing endpoint
java.lang.Exception: Socket bind failed: [13] Permission denied
at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:649)
at
org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
at
org.apache.catalina.connector.Connector.initialize(Connector.java:1022)
at
org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
at
org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
at org.apache.catalina.startup.Bootstrap.init(Bootstrap.java:276)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
org.apache.commons.daemon.support.DaemonLoader.load(DaemonLoader.java:212)
Nov 28, 2011 2:41:41 PM org.apache.catalina.core.StandardService initialize
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-80]]
LifecycleException: Protocol handler initialization failed:
java.lang.Exception: Socket bind failed: [13] Permission denied
at
org.apache.catalina.connector.Connector.initialize(Connector.java:1024)
at
org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
at
org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
at org.apache.catalina.startup.Bootstrap.init(Bootstrap.java:276)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
org.apache.commons.daemon.support.DaemonLoader.load(DaemonLoader.java:212)
Nov 28, 2011 2:41:41 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 293 ms
Nov 28, 2011 2:41:41 PM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
Nov 28, 2011 2:41:41 PM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.33
Nov 28, 2011 2:41:41 PM org.apache.catalina.ha.tcp.SimpleTcpCluster start
INFO: Cluster is about to start
....
On Mon, Nov 28, 2011 at 14:39, Konstantin Kolinko <kn...@gmail.com>wrote:
> 2011/11/28 Óscar Frías Barranco <of...@gmail.com>:
> > Hi.
> >
> > I want to start Tomcat 6.0.33 (running on port 80) from the command line
> of
> > a non-root user. I have set the setuid flag in the jsvc binary to
> > "convert" the non-root user to root at the time of execution. Then the
> > jsvc binary is executed with the "--user tomcat" parameter.
> >
> > The thing is that the whole setup works and I can successfully start
> Tomcat
> > from a non-root user command line if I don't use APR (libtcnative-1).
> >
> > But then I installed APR and now I can only start Tomcat from root
> command
> > line. If I try to start Tomcat from the non-root user command line I get
> > the exception at the bottom.
> >
> > Why is this happening? Is this a Tomcat bug? Do I have to setuid
> another
> > file besides "jsvc"? Thanks!
> >
> >
> > INFO: JvmRouteBinderValve started
> > Nov 28, 2011 1:28:25 PM org.apache.coyote.http11.Http11AprProtocol start
> > SEVERE: Error starting endpoint
> > java.lang.Exception: Socket bind failed: [13] Permission denied
> > at
> org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:649)
> > at
> > org.apache.tomcat.util.net.AprEndpoint.start(AprEndpoint.java:766)
> > at
> >
> org.apache.coyote.http11.Http11AprProtocol.start(Http11AprProtocol.java:137)
> > at
> > org.apache.catalina.connector.Connector.start(Connector.java:1095)
> > at
> > org.apache.catalina.core.StandardService.start(StandardService.java:540)
> > at
> > org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
> > at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
>
> What messages are before this one in the logs?
> (Clear the log files and then start Tomcat).
>
> Normally the workflow is the following:
> 1) init() initializes connectors and port binding happens
> 2) priviledges are dropped
> 3) start()
>
> Your stacktrace is from start(). I wonder why it is so, but without
> looking in the sources I cannot say more. Please provide full logs as
> I mentioned above.
>
> You may have better luck with 7.0.x. Lifecycle handling was improved in
> 7.0.
> In 7.0.x there is explicit "bindOnInit" attribute in connectors.
>
> Best regards,
> Konstantin Kolinko
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Problem starting Tomcat + APR on port 80 using jsvc with setuid
Posted by Konstantin Kolinko <kn...@gmail.com>.
2011/11/28 Óscar Frías Barranco <of...@gmail.com>:
> Hi.
>
> I want to start Tomcat 6.0.33 (running on port 80) from the command line of
> a non-root user. I have set the setuid flag in the jsvc binary to
> "convert" the non-root user to root at the time of execution. Then the
> jsvc binary is executed with the "--user tomcat" parameter.
>
> The thing is that the whole setup works and I can successfully start Tomcat
> from a non-root user command line if I don't use APR (libtcnative-1).
>
> But then I installed APR and now I can only start Tomcat from root command
> line. If I try to start Tomcat from the non-root user command line I get
> the exception at the bottom.
>
> Why is this happening? Is this a Tomcat bug? Do I have to setuid another
> file besides "jsvc"? Thanks!
>
>
> INFO: JvmRouteBinderValve started
> Nov 28, 2011 1:28:25 PM org.apache.coyote.http11.Http11AprProtocol start
> SEVERE: Error starting endpoint
> java.lang.Exception: Socket bind failed: [13] Permission denied
> at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:649)
> at
> org.apache.tomcat.util.net.AprEndpoint.start(AprEndpoint.java:766)
> at
> org.apache.coyote.http11.Http11AprProtocol.start(Http11AprProtocol.java:137)
> at
> org.apache.catalina.connector.Connector.start(Connector.java:1095)
> at
> org.apache.catalina.core.StandardService.start(StandardService.java:540)
> at
> org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
> at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
What messages are before this one in the logs?
(Clear the log files and then start Tomcat).
Normally the workflow is the following:
1) init() initializes connectors and port binding happens
2) priviledges are dropped
3) start()
Your stacktrace is from start(). I wonder why it is so, but without
looking in the sources I cannot say more. Please provide full logs as
I mentioned above.
You may have better luck with 7.0.x. Lifecycle handling was improved in 7.0.
In 7.0.x there is explicit "bindOnInit" attribute in connectors.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Problem starting Tomcat + APR on port 80 using jsvc with setuid
Posted by André Warnier <aw...@ice-sa.com>.
Óscar Frías Barranco wrote:
> Hi.
>
> I want to start Tomcat 6.0.33 (running on port 80) from the command line of
> a non-root user. I have set the setuid flag in the jsvc binary to
> "convert" the non-root user to root at the time of execution. Then the
> jsvc binary is executed with the "--user tomcat" parameter.
Sorry, this is not a direct answer to your question, and I don't know either why it would
work without APR and not with it.
But, instead of doing this via a setuid root script, could you not do this using the
"sudo" command ? It is specifically designed to do things like that.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org