Atomicorp

Security for Everyone
https://forums.atomicorp.com/

eaccelerator errors

https://forums.atomicorp.com/viewtopic.php?t=4990

Page 1 of 1

eaccelerator errors

Posted: Fri Apr 29, 2011 12:00 pm
by hostingguy
I get dozens of these on 5.3.6 with eaccelerator

Code: Select all

Received From: server->/var/log/httpd/error_log
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

EACCELERATOR: Open for write failed for "/var/cache/php-eaccelerator/0/c//eaccelerator-0caf7067cdc61bcdb768bc3a33c7b8fe": Permission denied
it looks like the permissions are not quite right

Code: Select all


# ls -la /var/cache/php-eaccelerator/0/c//eaccelerator-0caf7067cdc61bcdb768bc3a33c7b8fe
ls: /var/cache/php-eaccelerator/0/c//eaccelerator-0caf7067cdc61bcdb768bc3a33c7b8fe: No such file or directory


# ls -la /var/cache/php-eaccelerator/0/c//
total 1512
drwxrwxrwx  2 apache apache   4096 Apr 29 06:52 .
drwxrwxrwx 18 apache apache   4096 Apr 20 12:36 ..
-rw-------  1 apache apache  61272 Apr 29 06:52 eaccelerator-0c0573f4c305946842774c090b18df9c
-rw-------  1 apache apache   3696 Apr 28 13:02 eaccelerator-0c09f8372ae7d10b0dbbdfec4311e238
-rwxrwxrwx  1 apache apache  22536 Apr 21 09:57 eaccelerator-0c119dc275d24dd26a53701b8264427e
-rw-------  1 apache apache  11360 Apr 28 15:55 eaccelerator-0c1b8561b87db6f36922c9e3a68a4318
-rwxrwxrwx  1 apache apache   8328 Apr 26 22:05 eaccelerator-0c2afb6459d0e70e2dd5e8bd36490f7a
-rwxrwxrwx  1 apache apache 105352 Apr 24 07:55 eaccelerator-0c2cab5b17e0874b9b139b9ce5541872
-rwxrwxrwx  1 apache apache   5984 Apr 22 20:33 eaccelerator-0c39b9248f15b27df404125ff5049704
-rwxrwxrwx  1 apache apache 114888 Apr 27 04:45 eaccelerator-0c406f88f9f4c764d442a91880877a93
-rwxrwxrwx  1 apache apache  69112 Apr 27 04:45 eaccelerator-0c4cd67c9ebe5c5eaf20eb43f3af6ad2
-rwxrwxrwx  1 apache apache  25024 Apr 21 10:57 eaccelerator-0c4cee97b0ccf75857adbd17c65f2a64
-rwxrwxrwx  1 apache apache  24672 Apr 21 10:32 eaccelerator-0c4d3e795720285b1dc7a6ef6c7d610b
-rw-------  1 apache apache   2736 Apr 29 06:48 eaccelerator-0c57bd0b2aba4f75734e073b981c318c
-rwxrwxrwx  1 apache apache 110016 Apr 21 16:46 eaccelerator-0c8aa7a2c9adc53569a42c99b1e8391b
-rwxrwxrwx  1 apache apache  66080 Apr 21 09:59 eaccelerator-0cb69371b3cb8c42724a9a52976a9917
-rwxrwxrwx  1 apache apache 200792 Apr 21 09:55 eaccelerator-0cb9ce962dcc2a45227e7d299c8e0a68
-rw-------  1 apache apache 366384 Apr 29 06:24 eaccelerator-0ccda6eb5ffea222e2391e32455e0980
-rwxrwxrwx  1 apache apache  31656 Apr 22 01:42 eaccelerator-0ce84c16f94c2f1dd1d666a6b561e76d
-rwxrwxrwx  1 apache apache  23504 Apr 21 10:03 eaccelerator-0ceb0e9b0fe49fd344682ed2031bc0f7
-rwxrwxrwx  1 apache apache   3208 Apr 27 04:45 eaccelerator-0cf15f38e62b5344b19fe7aa0d6720dc
-rwxrwxrwx  1 apache apache 204840 Apr 21 10:24 eaccelerator-0cf931cb4aefb0cafc93af6625304387

Question #1 - if these files and folders are 777 and owned by apache:apache - shouldnt w/e process is attempting to write the eaccelerator files be able to write them ok?
Question #2 - why are some of them set to 777 and others are set to 600?
Question #3 - why are some servers set to apache:apache while others are set to root:root ? Which is correct?

Re: eaccelerator errors

Posted: Fri Apr 29, 2011 4:09 pm
by scott
Its going to have to be writable by the process that is running the application. Thats normally apache, but if you're using mod_ruid2 or ITK its going to be the userid for the domain.

There is a trigger in there to fix the permissions on /var/cache/php-eacclerator to make that directory world writable. mod_ruid2 is clever enough that it will create those files as 0600, which is what I think Im seeing here (assuming you have forced some domains to run as apache w/ mod_ruid2). You might have a condition where an application created that bytecode as apache before mod_ruid2 was enabled or after it was reconfigured, so now its trying to update the file as a different userid. The fix would then be to clean the cache out and see if the files are created as the new user.

Re: eaccelerator errors

Posted: Fri Apr 29, 2011 4:16 pm
by hostingguy
we dont use ruid becuase it wouldnt play nice with the rest of the system. So in this case there is no ITK or ruid installed, its just a normal psa 9.5.x installation (if such a thing exists).

Re: eaccelerator errors

Posted: Fri Apr 29, 2011 4:26 pm
by scott
FCGI maybe? Or suphp? Ive never looked to see if the CGI approach will make use of eaccelerator or not, but that error tells me its trying to run as a user other than apache.

Re: eaccelerator errors

Posted: Fri Apr 29, 2011 4:28 pm
by hostingguy
all the directories are 777 - would that mean any user could write to it no matter the method (cgi/fcgi/apache) ?

Re: eaccelerator errors

Posted: Tue May 03, 2011 12:20 pm
by hostingguy
it looks like its not creating all files properly - the root owned files are all 777 while the apache owned files are only 600 - so thats probably why its getting the permission problems.
Received From: server09 ->/var/log/httpd/error_log
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

EACCELERATOR: Open for write failed for "/var/cache/php-eaccelerator/0/c//eaccelerator-0caf7067cdc61bcdb768bc3a33c7b8fe": Permission denied

Code: Select all

[root@server09 ~]# cd /var/cache/php-eaccelerator/0/c
[root@server09 c]# ls -la
total 1428
drwxrwxrwx  2 root   root     4096 May  3 08:15 .
drwxrwxrwx 18 root   root     4096 Apr 20 12:36 ..
-rwxrwxrwx  1 root   root    22536 Apr 21 09:57 eaccelerator-0c119dc275d24dd26a53701b8264427e
-rw-------  1 apache apache  11360 May  1 23:46 eaccelerator-0c1b8561b87db6f36922c9e3a68a4318
-rw-------  1 apache apache 105352 May  3 08:15 eaccelerator-0c2cab5b17e0874b9b139b9ce5541872
-rwxrwxrwx  1 root   root     5984 Apr 22 20:33 eaccelerator-0c39b9248f15b27df404125ff5049704
-rwxrwxrwx  1 root   root   114888 Apr 27 04:45 eaccelerator-0c406f88f9f4c764d442a91880877a93
-rwxrwxrwx  1 root   root    69112 Apr 27 04:45 eaccelerator-0c4cd67c9ebe5c5eaf20eb43f3af6ad2
-rw-------  1 apache apache  25024 May  3 07:56 eaccelerator-0c4cee97b0ccf75857adbd17c65f2a64
-rwxrwxrwx  1 root   root    24672 Apr 21 10:32 eaccelerator-0c4d3e795720285b1dc7a6ef6c7d610b
-rwxrwxrwx  1 root   root   110016 Apr 21 16:46 eaccelerator-0c8aa7a2c9adc53569a42c99b1e8391b
-rw-------  1 apache apache  66080 Apr 30 09:40 eaccelerator-0cb69371b3cb8c42724a9a52976a9917
-rwxrwxrwx  1 root   root   200792 Apr 21 09:55 eaccelerator-0cb9ce962dcc2a45227e7d299c8e0a68
-rw-------  1 apache apache 366384 May  2 01:57 eaccelerator-0ccda6eb5ffea222e2391e32455e0980
-rwxrwxrwx  1 root   root    31656 Apr 22 01:42 eaccelerator-0ce84c16f94c2f1dd1d666a6b561e76d
-rwxrwxrwx  1 root   root    23504 Apr 21 10:03 eaccelerator-0ceb0e9b0fe49fd344682ed2031bc0f7
-rwxrwxrwx  1 root   root     3208 Apr 27 04:45 eaccelerator-0cf15f38e62b5344b19fe7aa0d6720dc
-rwxrwxrwx  1 root   root   204840 Apr 21 10:24 eaccelerator-0cf931cb4aefb0cafc93af6625304387
Its odd, but it only seems to occur on this box, none of the other ones seem to be throwing this error - at least as far as the ossec emails go.

Re: eaccelerator errors

Posted: Wed May 04, 2011 12:27 pm
by hostingguy
I removed and re-installed the package and then did a stop and start of apache and now the errors have gone away.
All times are UTC-04:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited