Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just set up a FreeBSD jail to run httpd in it and all works good except these two, rewrite/proxy modules.

These are error logs excerpts:

mod_rewrite error:

[rewrite:crit] [pid 43447] (13)Permission denied: AH00666: mod_rewrite: could not init rewrite_mapr_lock_acquire in child

mod_proxy error:

[proxy:crit] [pid 43447] (13)Permission denied: AH02479: could not init proxy_mutex in child

Not sure permissions of what are being denied as html in document root is being served just fine when these modules are disabled.

I tried googling but found nothing but rubbish.

share|improve this question

Sounds like your jail lacks permissions for SysV IPC. Try to set sysvipc_allow=1 in your jail settings or pass it with jail command.

share|improve this answer
how does that harm isolation i'm trying to achieve? – purpler Aug 5 '14 at 6:37
@purpler The handbook covers that: – Thor Erik Aug 5 '14 at 7:13
"By default, this sysctl is set to 0. If it were set to 1, it would defeat the whole purpose of having a jail". So that's out of question. Why would mod_rewrite and mod_proxy need IPC? – purpler Aug 5 '14 at 7:19
If I've understood right, FreeBSD 9.x and later do allow setting sysvipc_allow and plethora of other restrictions on per-jail basis instead of global sysctl values. – Janne Pikkarainen Aug 5 '14 at 7:24
I don't think we could call this a restriction, rather permission which renders the point of having jails completely useless. – purpler Aug 5 '14 at 7:52
up vote 0 down vote accepted

The issue were permissions.

I set /etc/pw.conf umask to 007 from default 022 and that resulted in certain executables being unable to be reached from jails.

Once i changed containing directory permissions to original ones it all started working properly and modules are not logging errors any more.

Typical example of PEBKAC.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.