I am learning fossil and it works fine on my local machine. But when I deploy my foobar depository to my virtual machine centos7 using apache and cgi following the instructions from the fossil book. it works, Except that when I try to login on the home page, the error shows "Database error: attempt to write a readonly database: {REPLACE INTO config(name,value) VALUES('captcha-secret', lower(hex(randomblob(20))));}".

The structure is as follows:

/fossil/
/fossil/dev/
/fossil/dev/null
/fossil/dev/urandom
/fossil/fossil
/fossil/repo/
/fossil/repo/foo.fossil

# and the structure of cgi
/var/www/cgi-bin/foo.cgi

To make it work first, i just chmod -R 777.
as:
crwxrwxrwx. 1 apache apache 1, 3 Nov 27 22:12 null
crwxrwxrwx. 1 apache apache 1, 9 Nov 27 22:13 urandom
-rwxrwxrwx. 1 apache apache 487424 Nov 27 21:39 poem1.fossil
-rwxrwxrwx. 1 apache apache 55 Nov 27 21:48 var/www/cgi-bin/poem1.cgi

What does the error message mean exactly? What could be wrong? or I miss something? Please give me some advice to solve this problem.

Thanks for the help. I realized that the problem could be the apache config. I modified the apache config as follows:

<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AddHandler cgi-script .cgi
    Require all granted
</Directory>

and

chown -R apache:apache /fossil/

But the same error message still shows up.

Could you please give me some more advice?

Show your poem.cgi contents.

Show what "ls -ld /fossil" prints.

ls -ld /fossil
drwxrwxrwx. 6 apache apache 75 Nov 27 22:03 /fossil

ls -ld /fossil/repo
drwxrwxrwx. 2 apache apache 46 Nov 27 21:39 /fossil/repo

ls -ld poem1.fossil
-rwxrwxrwx. 1 apache apache 487424 Nov 27 21:39 poem1.fossil

the cgi script:
#!/fossil/fossil
repository: /fossil/repo/poem1.fossil

chown -R apache:apache /fossil/

You almost certainly don't want this.

Nothing under your /fossil/ chroot should be owned or writable to apache with the exception of /fossil/repo and /fossil/repo/*.fossil. /fossil/repo should probably be owned by apache (and group apache) mode 775 and the fossil repo should be the same owner/group (apache.apache) mode 664. (This assumes that your web server is running as the apache user and not a user like www-data.)

Also /fossil/dev/null should be read/write (but not executable) to all but owned by root. This is probably how /dev/null is owned/permissioned. Similarly, you want to change /fossil/dev/urandom to match the owner/group/permissions from /dev/urandom.

This prevents the user apache from trivially changing any of the files/directories that can be used to break out of the chroot environment.

It has been a long time since I last configured apache for CGI use. However, the error message you are getting comes from fossil. If you had incorrectly configured the CGI, you would see the script in the browser (it wouldn't be executed). There is IIRC an option to run the CGI as a different user than the web server.

It's possible that's what you are running into if you have properly set up the permissions on /fossil/repo (as recommended drh) by and /fossil/repo/*.fossil. However, you haven't (AFAICT) shown what the owner/permission is on these two items. E.G. mode 555 on /fossil/repo would show the behavior you are reporting.

While all this is true, I expect this is going to come down to an SELinux restriction. RHEL 7 tightened things down a lot, requiring that you follow LHS standards to fit into its view of The Way Things Ought to Be.™

This question on ServerFault isn't formally answered, but I'd give that tip about putting the repo under /srv/www/fossil or similar a try. It is very much the sort of thing RHEL systems care about these days.

Ask me how I know. :)

CentOS 7 runs it as "apache", so what we've seen so far is sensible.

I'm still reasonably certain this is an SELinux issue. I don't blame those who have not worked on recent RHEL systems for not believing it can be this picky, but yes, it can.

Yup. Given the permissions reported, SELinux is looking more likely. sestatus or getenforce probably report enforcing.

For testing only: running sudo setenforce 0 and verify that getenforce reports permissive. Then restart the fossil daemon (without rebooting the system) to see if it works.

If it does, then you need to look into audit2allow and other docs on creating a custom policy. Changing the SELinux labels on the files you have deployed is another way to do it.

Warning building a custom policy can cause hair loss 8-). There is a reason I prefer apparmour to SELinux 8-).

you need to look into audit2allow

Or just move the service to a directory that allows CGI execution per the above-linked advice. No need to fight the model for anticpated cases.

Many thanks. I will try it on Ubuntu 20.4 then report.

When I try it on virtual Ubuntu 20.4, everything is fine.

I saw this message: "Ubuntu does not allow access through the web browser to any file apart of those located in /var/www" when I install apache. so I put fossil repo/ under /var/www/. It could be the same thing on Centos7, as it seems to me a policy of apache. But I havn't tried it.

Thanks for all your helps.