Apache CGI error "read permission denied for repository"
(1) By Kevin (kevgrig) on 2021-06-25 01:08:41 [link] [source]
Hi, I'm following the Cookbook recipe on configuring Apache CGI at the root of a website but I receive an HTTP 500 and the following error in the httpd log:
[Fri Jun 25 00:51:56.149459 2021] [cgid:error] [pid 3519:tid 3729] [client 69.110.60.183:44170] read permission denied for repository /var/lib/fossil/example.fossil: /var/www/cgi-bin/fossil.cgi
The CGI file is:
$ ls -l /var/www/cgi-bin/fossil.cgi
-rwxr-xr-x. 1 apache apache 72 Jun 25 00:43 /var/www/cgi-bin/fossil.cgi
$ cat /var/www/cgi-bin/fossil.cgi
#!/usr/bin/fossil
repository: /var/lib/fossil/example.fossil
The fossil repository is:
$ ls -l /var/lib/fossil/example.fossil
-rwxrwxrwx. 1 apache apache 229376 Jun 24 23:43 /var/lib/fossil/example.fossil
$ file /var/lib/fossil/example.fossil
/var/lib/fossil/example.fossil: SQLite 3.x database (Fossil repository), last written using SQLite version 3034001
The parent directories of both have execute permission:
$ ls -ld /var
drwxr-xr-x. 20 root root 4096 Jun 24 23:39 /var
$ ls -ld /var/www
drwxr-xr-x. 4 root root 4096 Jun 24 23:39 /var/www
$ ls -ld /var/www/cgi-bin/
drwxr-xr-x. 2 root root 4096 Jun 25 00:43 /var/www/cgi-bin/
$ ls -ld /var/lib/
drwxr-xr-x. 26 root root 4096 Jun 24 23:58 /var/lib/
$ ls -ld /var/lib/fossil/
drwxr-xr-x. 2 root root 4096 Jun 24 23:43 /var/lib/fossil/
I tried to strace the httpd process but it uses Unix sockets to spawn the CGI program and I don't know how to strace that:
3729 00:51:56.114676 openat(AT_FDCWD, "/var/www/cgi-bin/fossil.cgi", O_RDONLY|O_CLOEXEC) = 26
3729 00:51:56.114716 read(26, "#!/usr/bin/fossil\nrepository: /v"..., 4096) = 72
3729 00:51:56.114848 close(26) = 0
3729 00:51:56.114899 socket(AF_UNIX, SOCK_STREAM, 0) = 26
3729 00:51:56.114952 connect(26, {sa_family=AF_UNIX, sun_path="/etc/httpd/run/cgisock.3515"}, 29) = 0
3729 00:51:56.115268 sendmsg(26, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\1\0\0\0\0\0\0\0\230\0\0\0\0\0\0\0\273\r\0\0=\0\0\0\377\377\377\377\377\377\377\377"..., iov_len=152}, {iov_base="/var/www/cgi-bin/fossil.cgi", iov_len
=27}, {iov_base="/var/www/cgi-bin/fossil.cgi", iov_len=27}, {iov_base="/", iov_len=1}], msg_iovlen=4, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[25]}], msg_controllen=24, msg_flags=0}, 0) = 207
Apache configuration uses:
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
</Directory>
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/tmp/.*$
RewriteCond %{REQUEST_URI} !^/cgi-bin/.*$
RewriteRule ^(.*)$ /var/www/cgi-bin/fossil.cgi/$1 [T=application/x-httpd-cgi]
I restarted Apache. This is on a fresh Fedora 34 x64 on Digital Ocean.
I added cgi-debug: /tmp/fossil.log to the CGI program but /tmp/fossil.log was not produced after refreshing.
The shebang of the CGI script points to the following which seems to be fine:
$ /usr/bin/fossil version
This is fossil version 2.14 [487776dc45] 2021-01-20 15:34:40 UTC
Any ideas?
(2) By Kevin (kevgrig) on 2021-06-25 01:42:18 in reply to 1 [link] [source]
By stracing all httpd processes, I can see the error now:
6059 01:35:09.390932 access("/var/lib/fossil/example.fossil", R_OK <unfinished ...>
6059 01:35:09.391769 <... access resumed>) = -1 EACCES (Permission denied)
6059 01:35:09.391858 access("/var/lib/fossil/example.fossil", F_OK <unfinished ...>
6059 01:35:09.391956 <... access resumed>) = 0
6059 01:35:09.392048 access("/var/lib/fossil/example.fossil", R_OK <unfinished ...>
6059 01:35:09.392614 <... access resumed>) = -1 EACCES (Permission denied)
6059 01:35:09.392720 write(2, "read permission denied for repos"..., 80 <unfinished ...>
I don't understand why though as the file has read permission for all and the directories have execute permissions for all.
(3) By Kevin (kevgrig) on 2021-06-25 01:48:35 in reply to 2 [link] [source]
journalctl showed the error:
Jun 25 01:35:09 audit[6059]: AVC avc: denied { read } for pid=6059 comm="fossil.cgi" name="example.fossil" dev="vda1" ino=263570 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=0
This was caused by SELinux.
(4) By Stephan Beal (stephan) on 2021-06-25 02:38:55 in reply to 2 [link] [source]
I don't understand why though as the file has read permission for all and the directories have execute permissions for all.
You need not only write permission to the repo but also its directory - sqlite needs that for its journal. AFAIK, fossil is currently unable to work properly with read-only repos, in particular for non-anonymous access so that it can record/update the user's login cookie.
(5) By Kevin (kevgrig) on 2021-06-25 05:12:10 in reply to 4 [link] [source]
Hey Stephan, Thanks, yes, I ran into that issue after I fixed the SELinux error and I had to give write access to the directory.
(6) By anonymous on 2021-06-25 07:30:36 in reply to 4 [source]
That suggests that the content on https://fossil-scm.org/home/wiki?name=Cookbook#CGI should probably add something like 6. Ensure that the repository directory is writable to the CGI user account after 4. Ensure that every directory in the path leading to the repository is browseable (chmod +x) to the CGI user account. 5. Ensure that the repository file is readable and writable to the CGI user account. and the example shell script should include something like chgrp $CGI_GROUP . chmod g+w . within the then...else but outside the for...done With perhaps a note about "if you are using another access control system, such as AppArmor or SELinux, you will want to make sure that the CGI user account is allowed to read and write the necessary files". If someone already has write-permission to the wiki, feel free to polish-and-paste that in. Cheers,
(7) By Stephan Beal (stephan) on 2021-06-25 07:37:58 in reply to 6 [link] [source]
That suggests that the content on https://fossil-scm.org/home/wiki?name=Cookbook#CGI ...
That particular page is not maintained - its last edit was 8.5 years ago. However, the relevant documentation already mentions your first suggestion:
src:/doc/trunk/www/server/any/cgi.md
and i will get your suggestion about AppArmor/SELinux integrated in a moment.
(8) By John Rouillard (rouilj) on 2021-06-25 13:57:42 in reply to 7 [link] [source]
Probably worth updating the cookbook page to remove obsolete info and refer to documentation.
(9) By Stephan Beal (stephan) on 2021-06-25 15:59:59 in reply to 8 [link] [source]
Probably worth updating the cookbook page to remove obsolete info and refer to documentation.
i put a warning at the top with a link to the main doc index and added a link in the CGI section to the CGI doc. If someone wants to go fish out a current /doc link for every section in the cookbook, they're welcome to do so :).