You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Arvind Shenoy <as...@gmail.com> on 2008/10/09 04:01:13 UTC
[users@httpd] initgroups() failure
Hello,
I recently installed httpd-2.2.9 (with LDAP and SSL) on my Mac OS X 10.5.4
box. Everything went very smoothly except for one thing; Apache keeps
shutting down due to the following initgroups failures:
[Wed Sep 24 19:02:11 2008] [alert] (2)No such file or directory: initgroups:
unable to set groups for User <user> and Group <gid>
and
[Wed Oct 08 15:00:48 2008] [alert] (22)Invalid argument: initgroups: unable
to set groups for User <user> and Group <gid>
After doing quite a bit of research, I found a few others who had also run
into this problem (some of them dating back to 1995). However, I was unable
to find a solution. The main difference I am noticing with the problem I'm
having as compared to other users is that initgroups() seems to fail at what
seems like random intervals for me. I read up a bit on how this error was
getting thrown for some while trying to start httpd due to the user being a
member of too many groups. However, I don't think that is the problem here
and this error certainly has not been occurring when starting up httpd.
I tried to trace the code that was causing the issue and I found the
following (httpd-2.2.9/os/unix/unixd.c):
if (initgroups(name, unixd_config.group_id) == -1) {
ap_log_error(APLOG_MARK, APLOG_ALERT, errno, NULL,
"initgroups: unable to set groups for User %s "
"and Group %u", name, (unsigned
)unixd_config.group_id);
return -1;
}
One of the posts I read involved trying to resolve the issue by comparing
the initgroups() return value to 1. However, initgroups() returns a -1 for
errors (or when not called by a super-user) so comparing it to 1 would not
really be solving the problem. Lastly, I tried to set permissions for the
httpd script which is owned by root (/bin/httpd) to 4755 to try to prevent
initgroups from failing due to non-sudo calls. That seemed to fix it, but
after 1 week, it has crashed again. The main problem is that it seems to
crash very randomly.
The following is the ./configure command I used (if it helps):
./configure --prefix=/usr/local/httpd-2.2.9 --enable-mods-shared=most
--enable-ssl --enable-ldap --with-ldap --with-included-apr
--enable-auth-ldap --enable-authnz-ldap --enable-proxy
So after all this, I have a couple of questions. Can someone please point me
in the right direction for reproducing this problem? It *seems* to be pretty
random for me in terms of when it fails. Has anyone else run into this
problem? Does this problem have anything to do with the modules that I am
using or is it just something wrong with my Apache installation? And
finally, since initgroups() needs to be called by a super-user, how does it
ever return successfully at all?
I realize from all of the Googling I've done that this problem has been
occurring for httpd customers since 1995, however, I have had no luck in
finding a proper solution so any help would be greatly appreciated.
Thanks a bunch!
-AS
Re: [users@httpd] initgroups() failure
Posted by Dan Poirier <po...@pobox.com>.
Sorry, I'm not going to be able to help any more with this for a while,
so if anyone else has any ideas, please jump in.
--
Dan Poirier <po...@pobox.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] initgroups() failure
Posted by Arvind Shenoy <as...@gmail.com>.
On Thu, Oct 9, 2008 at 3:42 PM, Dan Poirier wrote
> You say "keeps shutting down". Do you mean it always crashes when
> you try to run it? Or that sometimes it works, for a while?
>
> If it always crashes, I'd try running "id" with the user that
> httpd is configured to run as. E.g.
>
> id poirier
>
> and make sure it shows that that user is a member of the group that
> httpd is configured to run as. I suggest confirming this by running
> "id" because Mac OS X doesn't necessarily use /etc/passwd and /etc/group
> to store that information, and maybe those files look right but Mac OS X
> is confused.
>
> If it crashes now and then, I wonder why it's even running that code
> after startup. If it's starting and stopping child processes regularly,
> maybe you could tweak your MPM settings so it starts the servers it
> needs at startup and just keeps them running.
>
Thanks for replying Dan. To answer your question, it works all of the time
for a few hours and then crashes randomly anywhere between a few hours to a
few days later. The user/group combination that I am using in Apache was in
fact put together using Mac OS X's directory services utilities (since
/etc/group is not used) and therefore, when I do an `id <user>` call, one of
the groups that is returned happens to be the group I am assigning in
Apache, which falls in line with the expected behavior.
I will try out your suggestion for tweaking MPM settings though it seems as
that may simply delay the inevitable.
As for the user needing to be root to fall through to that part of the code,
perhaps I should try starting up apache as a regular user (i.e. apachectl
start instead of sudo apachectl start). The only reason I currently use sudo
is that Mac OS X seems to require super user access to bind to a privileged
port. I may be able to get around this by using launchd to start it up and
changing ownership of some of the directories. Is this something that would
be worthwhile to try?
Thanks again,
-AS
Re: [users@httpd] initgroups() failure
Posted by Dan Poirier <po...@pobox.com>.
[rearranged to fix top-posting]
On Wed, Oct 8, 2008 at 10:01 PM, Arvind Shenoy <ma...@gmail.com> wrote:
> I recently installed httpd-2.2.9 (with LDAP and SSL) on my Mac OS X 10.5.4
> box. Everything went very smoothly except for one thing; Apache keeps
> shutting down due to the following initgroups failures:
> [Wed Sep 24 19:02:11 2008] [alert] (2)No such file or directory: initgroups:
> unable to set groups for User <user> and Group <gid>
> and
> [Wed Oct 08 15:00:48 2008] [alert] (22)Invalid argument: initgroups: unable
> to set groups for User <user> and Group <gid>
On Thu, Oct 9, 2008 at 5:41 AM, Dan Poirier wrote:
> The man page for initgroups on Mac OS X says only: The initgroups()
> function returns -1 if it was not invoked by the superuser. But
> looking at the code, there are other possible causes.
>
> Arvind, have you checked the console for any messages that Mac OS X
> might have logged at the time of the problem? If directory services
> is having problems, it might log them there.
> (/Applications/Utilities/Console.app).
"Arvind Shenoy" <as...@gmail.com> writes:
> Unfortunately, there are no related messages
> in Console.app. System.log also does not raise any red flags. I would
> really like to find out (but don't know exactly how to go about
> it) is whether the initgroups() call is failing because of not being
> called by the super-user or because of something else.
The odd thing is, the call is inside "if (!geteuid())", so it won't
even get called unless running as root.
You say "keeps shutting down". Do you mean it always crashes when
you try to run it? Or that sometimes it works, for a while?
If it always crashes, I'd try running "id" with the user that
httpd is configured to run as. E.g.
id poirier
and make sure it shows that that user is a member of the group that
httpd is configured to run as. I suggest confirming this by running
"id" because Mac OS X doesn't necessarily use /etc/passwd and /etc/group
to store that information, and maybe those files look right but Mac OS X
is confused.
If it crashes now and then, I wonder why it's even running that code
after startup. If it's starting and stopping child processes regularly,
maybe you could tweak your MPM settings so it starts the servers it
needs at startup and just keeps them running.
Dan
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] initgroups() failure
Posted by Arvind Shenoy <as...@gmail.com>.
Dan,
Thanks for replying. Unfortunately, there are no related messages in
Console.app. System.log also does not raise any red flags. I would really
like to find out (but don't know exactly how to go about it) is whether the
initgroups() call is failing because of not being called by the super-user
or because of something else. I wrote a small C program that called
initgroups and tried calling it when httpd was working correctly as well as
after it had crashed due to the initgroups() failure. In both cases, the
initgroups call in my program returned successfully (0) when the program was
called with a sudo.
The following is a small snippet of the code I threw together:
gid_t *gids, gid;
int ngroups;
gid = (gid_t) <group id>;
int ret = initgroups("<user>", gid);
It may also be important to note that the user and group that I have defined
in Apache are NOT the standard (_)www/(_)www or daemon/daemon users.
However, the user I set httpd to run as, is a member of the group that
apache is running as. Also, the crash occurs regardless of what user/group
combination I use, so I'm not sure if that narrows down the problem at all.
Again, thanks for replying and any thoughts/suggestions would be greatly
appreciated.
Thanks,
-AS
On Thu, Oct 9, 2008 at 5:41 AM, Dan Poirier <po...@pobox.com> wrote:
> Eric Covener said the following on 10/08/2008 10:43 PM:
>
>> On Wed, Oct 8, 2008 at 10:01 PM, Arvind Shenoy <as...@gmail.com>
>> wrote:
>>
>>> Hello,
>>> I recently installed httpd-2.2.9 (with LDAP and SSL) on my Mac OS X
>>> 10.5.4
>>> box. Everything went very smoothly except for one thing; Apache keeps
>>> shutting down due to the following initgroups failures:
>>> [Wed Sep 24 19:02:11 2008] [alert] (2)No such file or directory:
>>> initgroups:
>>> unable to set groups for User <user> and Group <gid>
>>> and
>>> [Wed Oct 08 15:00:48 2008] [alert] (22)Invalid argument: initgroups:
>>> unable
>>> to set groups for User <user> and Group <gid>
>>>
>>
>> trivia that may help, I've seen initgroups() crash when LDAP is used
>> on linux from nsswitch.conf and Apache is linked with some other LDAP.
>>
>> Does initgroups have anything interesting in the manual your system
>> for those errno values?
>>
>>
> The man page for initgroups on Mac OS X says only: The initgroups()
> function returns -1 if it was not invoked by the superuser. But
> looking at the code, there are other possible causes.
>
> Arvind, have you checked the console for any messages that Mac OS X
> might have logged at the time of the problem? If directory services
> is having problems, it might log them there.
> (/Applications/Utilities/Console.app).
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] initgroups() failure
Posted by Dan Poirier <po...@pobox.com>.
Eric Covener said the following on 10/08/2008 10:43 PM:
> On Wed, Oct 8, 2008 at 10:01 PM, Arvind Shenoy <as...@gmail.com> wrote:
>> Hello,
>> I recently installed httpd-2.2.9 (with LDAP and SSL) on my Mac OS X 10.5.4
>> box. Everything went very smoothly except for one thing; Apache keeps
>> shutting down due to the following initgroups failures:
>> [Wed Sep 24 19:02:11 2008] [alert] (2)No such file or directory: initgroups:
>> unable to set groups for User <user> and Group <gid>
>> and
>> [Wed Oct 08 15:00:48 2008] [alert] (22)Invalid argument: initgroups: unable
>> to set groups for User <user> and Group <gid>
>
> trivia that may help, I've seen initgroups() crash when LDAP is used
> on linux from nsswitch.conf and Apache is linked with some other LDAP.
>
> Does initgroups have anything interesting in the manual your system
> for those errno values?
>
The man page for initgroups on Mac OS X says only: The initgroups()
function returns -1 if it was not invoked by the superuser. But
looking at the code, there are other possible causes.
Arvind, have you checked the console for any messages that Mac OS X
might have logged at the time of the problem? If directory services
is having problems, it might log them there.
(/Applications/Utilities/Console.app).
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] initgroups() failure
Posted by Eric Covener <co...@gmail.com>.
On Wed, Oct 8, 2008 at 10:01 PM, Arvind Shenoy <as...@gmail.com> wrote:
> Hello,
> I recently installed httpd-2.2.9 (with LDAP and SSL) on my Mac OS X 10.5.4
> box. Everything went very smoothly except for one thing; Apache keeps
> shutting down due to the following initgroups failures:
> [Wed Sep 24 19:02:11 2008] [alert] (2)No such file or directory: initgroups:
> unable to set groups for User <user> and Group <gid>
> and
> [Wed Oct 08 15:00:48 2008] [alert] (22)Invalid argument: initgroups: unable
> to set groups for User <user> and Group <gid>
trivia that may help, I've seen initgroups() crash when LDAP is used
on linux from nsswitch.conf and Apache is linked with some other LDAP.
Does initgroups have anything interesting in the manual your system
for those errno values?
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org