You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jan Mattila <ja...@helsinki.fi> on 2003/10/02 12:47:51 UTC
[users@httpd] httpd-2.0.47 - Unable to run in chroot jail - not a bug
Hello.
My system is an LFS 3.3 (linux from scratch) based distribution
on and i586-pc-linux-gnu, with 2.4.18 kernel.
I am unable to run httpd (2.0.47) in a chroot jail. When I
try I only get:
[crit] (5)Input/output error: apr_proc_detach failed
Pre-configuration failed
in my error_log (with LogLevel debug). The same httpd.conf
works fine outside the jail, so this must be a configuration
problem, but what kind it is, I cannot say.
I've read all the FAQ's and the archives and there was one
posting in the archives from Werner Schalk (2003-08-08 21:17:43)
about a similar problem, but there was no reply and only a
little info in the mail. I'll try to be more informative.
So how did I get here?
I saw an interesting article by Artur Maj about running httpd
(1.3.x) in a chroot jail at http://www.securityfocus.com/infocus/1694
and thought I'd give it a go with the latest 2.0.x (2.0.47).
My configuration was the following:
./configure --prefix=/opt/apachek \
--disable-include --disable-env --disable-setenvif \
--disable-status --disable-autoindex --disable-asis \
--disable-cgi --disable-negotiation --disable-imap \
--disable-actions --disable-userdir --disable-so \
--disable-alias \
This would leave mod_access, mod_auth, mod_log_config,
mod_dir and mod_mime as the article suggested.
[Funny that there is no disable-all in 2.0.x configure...]
Make and make install went fine.
I then ldd'd the httpd to find out the needed libraries and got:
# ldd /opt/apachek/bin/httpd
libaprutil-0.so.0 => /opt/apachek/lib/libaprutil-0.so.0 (0x40016000)
libgdbm.so.2 => /usr/lib/libgdbm.so.2 (0x4002d000)
libdb-4.1.so => /usr/lib/libdb-4.1.so (0x40033000)
libexpat.so.0 => /opt/apachek/lib/libexpat.so.0 (0x400d4000)
libapr-0.so.0 => /opt/apachek/lib/libapr-0.so.0 (0x400f1000)
librt.so.1 => /lib/librt.so.1 (0x4010f000)
libm.so.6 => /lib/libm.so.6 (0x40120000)
libcrypt.so.1 => /lib/libcrypt.so.1 (0x40142000)
libnsl.so.1 => /lib/libnsl.so.1 (0x4016f000)
libdl.so.2 => /lib/libdl.so.2 (0x40184000)
libpthread.so.0 => /lib/libpthread.so.0 (0x40187000)
libc.so.6 => /lib/libc.so.6 (0x4019c000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
Then just to make sure I strace'd the httpd to find out if these
were the only things needed and if the libraries were searched
from somewhere else first and got this (just the grep open here):
open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/opt/apachek/lib/i586/mmx/libaprutil-0.so.0", O_RDONLY) = -1 ENOENT
(No such file or directory)
open("/opt/apachek/lib/i586/libaprutil-0.so.0", O_RDONLY) = -1 ENOENT (No
such file or directory)
open("/opt/apachek/lib/mmx/libaprutil-0.so.0", O_RDONLY) = -1 ENOENT (No
such file or directory)
open("/opt/apachek/lib/libaprutil-0.so.0", O_RDONLY) = 3
open("/opt/apachek/lib/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
open("/usr/lib/libgdbm.so.2", O_RDONLY) = 3
open("/opt/apachek/lib/libdb-4.1.so", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/usr/lib/libdb-4.1.so", O_RDONLY) = 3
open("/opt/apachek/lib/libexpat.so.0", O_RDONLY) = 3
open("/opt/apachek/lib/libapr-0.so.0", O_RDONLY) = 3
open("/opt/apachek/lib/librt.so.1", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/lib/librt.so.1", O_RDONLY) = 3
open("/opt/apachek/lib/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/lib/libm.so.6", O_RDONLY) = 3
open("/opt/apachek/lib/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file
or directory)
open("/lib/libcrypt.so.1", O_RDONLY) = 3
open("/opt/apachek/lib/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/lib/libnsl.so.1", O_RDONLY) = 3
open("/opt/apachek/lib/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/lib/libdl.so.2", O_RDONLY) = 3
open("/opt/apachek/lib/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file
or directory)
open("/lib/libpthread.so.0", O_RDONLY) = 3
open("/opt/apachek/lib/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or
directory)
open("/lib/libc.so.6", O_RDONLY) = 3
open("/opt/apachek/conf/httpd.conf", O_RDONLY) = 3
open("/etc/nsswitch.conf", O_RDONLY) = 4
open("/opt/apachek/lib/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such
file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 4
open("/lib/libnss_files.so.2", O_RDONLY) = 4
open("/etc/passwd", O_RDONLY) = 4
open("/etc/group", O_RDONLY) = 4
open("/opt/apachek/logs/access_log", O_WRONLY|O_APPEND|O_CREAT, 0666) = 4
open("/opt/apachek/logs/error_log", O_RDWR|O_APPEND|O_CREAT, 0666) = 7
open("/opt/apachek/conf/mime.types", O_RDONLY) = 8
open("/opt/apachek/conf/httpd.conf", O_RDONLY) = 5
It seemed to be looking for all the libraries except the
ld-linux.so.2 from /$ServerRoot/lib so I copied the
libraries to /chroot/kakkonen/lib and /chroot/kakkonen/usr/lib
and made symlinks to the $ServerRoot/lib directory in the
chroot jail.
Just to make sure I also ldd all the libraries but they
all point to libc.so.6 and ld-linux.so.2, so there seemed
to be no need for additional copying.
I also copied the passwd, group, mime.type, httpd.conf,
nsswitch.conf and libnss_files.so.2 to the jail
(libnss_files.so.2 being a symlink again like the libs
above).
In addition to these I copied, according to the article,
the /etc/hosts and /etc/resolv.conf to the jail.
Then I tried to run the bastard. Wouldn't go. Just gave me the
[crit] (5)Input/output error: apr_proc_detach failed
Pre-configuration failed
So I googled for the "apr_proc_detach failed" and found this:
http://www.tigress.com/nobs/apache2-error-messages.html
where it says that apr_proc_detach failed has to do with
(+ line file link to module-docu):
+1033 ./server/mpm/beos/beos.c
+1249 ./server/mpm/prefork/prefork.c
+1580 ./server/mpm/experimental/perchild/perchild.c
+1783 ./server/mpm/experimental/leader/leader.c
+1903 ./server/mpm/worker/worker.c
+2040 ./server/mpm/experimental/threadpool/threadpool.c
in call to function ap_log_error
So I thought there must be something with the perchild.c
since that's the default and that's what I had.
I couldn't get anywhere with the perchild.c problem so
I tried to run httpd out of the jail and it worked beautifully.
Then I strace'd both the httpd inside the jail and the
httpd outside and ran the output to a two separate files
and ran a diff between them and there seems to be no difference.
(after copying the libs to the outside jail httpd's /$ServerRoot/lib
and making sure the group and passwd files inside and outside
the jail were identical)
So I'm stumped. I cannot get httpd to work inside the
chroot jail.
Any ideas on where I could find some help?
I've put my diff of the two files mentioned above and
my httpd.conf after my sig.
--
Jan Mattila <ja...@helsinki.fi>
"Finland, Finland, Finland, Finland has it all."
- Michael Palin
My diff of the two straces looks like this:
1,22d0
< execve("/usr/sbin/chroot", ["chroot", "/chroot/kakkonen/",
"/opt/apachek/bin/httpd"], [/* 16 vars */]) = 0
< brk(0) = 0x804a248
< old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x40015000
< open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or
directory)
< open("/etc/ld.so.cache", O_RDONLY) = 3
< fstat64(3, {st_mode=S_IFREG|0644, st_size=7754, ...}) = 0
< old_mmap(NULL, 7754, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40016000
< close(3) = 0
< open("/lib/libc.so.6", O_RDONLY) = 3
< read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0(\226\1"..., 1024)
= 1024
< fstat64(3, {st_mode=S_IFREG|0755, st_size=5035424, ...}) = 0
< old_mmap(NULL, 1197120, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000
< mprotect(0x40132000, 42048, PROT_NONE) = 0
< old_mmap(0x40132000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED,
3, 0x119000) = 0x40132000
< old_mmap(0x40139000, 13376, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40139000
< close(3) = 0
< munmap(0x40016000, 7754) = 0
< brk(0) = 0x804a248
< brk(0x804a270) = 0x804a270
< brk(0x804b000) = 0x804b000
< chroot("/chroot/kakkonen/") = 0
< chdir("/") = 0
125c103
< getpid() = 24747
---
> getpid() = 24751
159c137
< stat64("/opt/apachek", {st_mode=S_IFDIR|0755, st_size=144, ...}) = 0
---
> stat64("/opt/apachek", {st_mode=S_IFDIR|0755, st_size=360, ...}) = 0
205c183
< stat64("/web", {st_mode=S_IFDIR|0755, st_size=104, ...}) = 0
---
> stat64("/web", {st_mode=S_IFDIR|0755, st_size=112, ...}) = 0
249c227
< stat64("/opt/apachek", {st_mode=S_IFDIR|0755, st_size=144, ...}) = 0
---
> stat64("/opt/apachek", {st_mode=S_IFDIR|0755, st_size=360, ...}) = 0
253,254c231
< fork() = 24749
< --- SIGCHLD (Child exited) @ 0 (0) ---
---
> fork() = 24753
My httpd.conf looks like this:
# =================================================
# Basic settings
# =================================================
ServerRoot "/opt/apachek"
PidFile /opt/apachek/logs/httpd.pid
# =================================================
# Performance settings
# =================================================
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
<IfModule prefork.c>
StartServers 5
MinSpareServers 5
MaxSpareServers 10
MaxClients 150
MaxRequestsPerChild 0
</IfModule>
# =================================================
# General settings
# =================================================
Listen 8080
User apachek
Group apachek
ServerAdmin me@mydomain.com
ServerName mydomain.com:8080
UseCanonicalName Off
ServerSignature Off
HostnameLookups Off
ServerTokens Prod
DirectoryIndex index.html
DocumentRoot "/web"
# =================================================
# Access control
# =================================================
<Directory />
Options None
AllowOverride None
Order allow,deny
Allow from all
</Directory>
AccessFileName .htaccess
<Files ~ "^\.ht">
Order allow,deny
Deny from all
</Files>
# =================================================
# MIME encoding
# =================================================
TypesConfig /opt/apachek/conf/mime.types
DefaultType text/plain
<IfModule mod_mime.c>
AddEncoding x-compress Z
AddEncoding x-gzip gz tgz
AddType application/x-tar .tgz
</IfModule>
# =================================================
# Logs
# =================================================
LogLevel debug
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
ErrorLog /opt/apachek/logs/error_log
CustomLog /opt/apachek/logs/access_log combined
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org