0

OS: CentOS 7 / Apache: 2.4

I'm upgrading machines and software, part of which has involved upgrading from Apache 2.2.x to Apache 2.4.x. A good portion of it works okay, inlcuding PHP scripts, and plain html files, but I'm having big problems trying to get Perl cgi scripts running.

Temporarily, while troubleshooting, I have disabled Selinux for httpd, (made permissive: ie. semanage permissive -a httpd_t) so I know that's not the problem.

I've tried numerous things, but the bottom line is that I can't run anything from /cgi-bin/. This particular site, for legacy reasons, is not under /var/www/ but under /home/www/htdocs/, but I think that would only be an issue for Selinux, which is disabled at the moment.

So, an example of the error messages I get in the Apache error log is below:

AH01215: Can't open perl script "/home/www/htdocs/zac/cgi-bin/test.cgi": Permission denied

I've tried different things, but I currently have "apache" as group owner of /cgi-bin/, with permissions of 777, and apache as owner and group of the scripts, with permissions of 777. The scripts are very simple, (just print a bit of text to test) and I've already deleted and re-added the top line in each script (i.e. #!/usr/bin/perl) to ensure there are no dodgy characters there.

I know that some of the syntax in the conf files are different in 2.4, but I think I have everything okay, see below:

<VirtualHost *>
DocumentRoot "/home/www/htdocs/zac/"
ServerName www.zacserver.pc
ServerAlias zacserver

ScriptAlias /cgi-bin/   "/home/www/htdocs/zac/cgi-bin/"

AddHandler cgi-script .cgi .pl

AddType application/x-httpd-php .html .php

<Directory "/home/www/htdocs/zac/">
AllowOverride all
Options ExecCGI Includes

Require all denied
Require ip 172.10       127.0.0.1
</Directory>

CustomLog "/var/www/sites/logs/zac_access.log" combined
ErrorLog  "/var/www/sites/logs/zac_error.log"
</VirtualHost>

Oddly, if I put the test.cgi script above the cgi-bin directory, into /zac/ then it works fine. I even have another directory, cgi-test, with identical ownership and permissions to cgi-bin, with the same script and permissions, and it works fine in there too; but nothing seems to work from /cgi-bin itself.

The ScriptAlias line, in the conf file above, I've also put tried with removing the quotes too, and restarting, but no effect. (not that I'd expect one).

So, I'm kinda struggling to find anything else that I can look at, as permissions seem fine, the scripts are fine, and so far as I know the conf config is also fine. Driving me bonkers!

Any assistance would be much appreciated. I have a feeling this must be something quite simple, but the solution is evading me.

Update: I've subsequently got this working by changing the file contexts back from httpd_sys_script_exec_t to httpd_sys_content_t with restorecon. No idea why this should work, as I'd have figured it should be the other way around.

1
  • You can use semanage fcontext -l | grep httpd_sys to see what contexts restorecond would apply on file changes, assuming you have restorecond running.
    – Aaron
    Dec 9, 2016 at 20:44

2 Answers 2

1

I've subsequently got this working by changing the file contexts back from httpd_sys_script_exec_t to httpd_sys_content_t with restorecon. No idea why this should work, as I'd have figured it should be the other way around.

1
  • I think you have to wait a day, then you can acknowledge your own answer as "the correct one."
    – Richard T
    Dec 10, 2016 at 2:37
0

You can't have permissions wide open, Apache thinks that's a security risk! Try 755.

2
  • You're right that 777 are poor permissions for a prod environment, but in this case it was just for testing. In fact changing to 755 (on both cgi-bin and the scripts) makes no difference in this case..
    – SuperDog
    Dec 9, 2016 at 17:48
  • @SuperDog Interesting; I was under the impression - supported by some experience and some behavior reported by others - that Apache WILL NOT run scripts in directories with the permissions wide open, however, perhaps with the SELinux stuff turned on, maybe it trusts its features. IDK. Anyway, you should advertise your solution by "answering your own question"!
    – Richard T
    Dec 9, 2016 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .