Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using mod_itk as MPM for increased security in shared environment. I also have a Firefox Sync Server within one of the VHosts I host. That vhost is restricted to a certain user via AssignUserId user group.

The problem is that the socket /var/run/wsgi...whatever.sock is chmodded srwx------ and owned by Apache's wwwrun. While I configured the vhost with

WSGIProcessGroup sync
WSGIDaemonProcess sync user=djechelon group=djechelon processes=1 threads=5

I still get the error that Apache wants to access a socket that is not accessible and because of this gets an error.

Is it possible to configure mod_wsgi in order to create different sockets with different owners for different applications or to chmod its socket in a different way (less secure)?

Currently, I'm running Firefox Sync as the only WSGI application. Moving it to a vhost that doesn't AssignUserId could solve this problem but will force me to change URL (and buy an additional SSL certificate), so I wouldn't consider this

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

You need mod_wsgi 3.3 or later, and the mod_wsgi source must be compiled against a full Apache with developer header files corresponding to the ITK MPM. You cannot use a binary of mod_wsgi compiled against worker or prefork MPM as the ITK support you need is a compile time thing.

Unfortunately the Linux distros who provide ITK MPM variant of Apache as an option, don't seem to provide httpd-dev or apache2-dev package variants corresponding to that same ITK MPM. As a result, people usually end up having to build up their own Apache from source code with ITK MPM and proper header files with ITK version of mpm.h to get it to work.

share|improve this answer
    
Accepted because I gave up on recompiling Apache on a production server :) I simply chose to disable AssignUserId for that vhost. Compromise is the keyword :) –  djechelon Oct 7 '12 at 12:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.