Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #201277 > unrolled thread

apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied

Started bysteve <dlist@bluewin.ch>
First post2018-10-16 07:40 +0200
Last post2018-10-16 10:50 +0200
Articles 5 on this page of 25 — 10 participants

Back to article view | Back to linux.debian.user

Contents

  apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-16 07:40 +0200
    Re: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied Steve Kemp <skx@debian.org> - 2018-10-16 08:50 +0200
      Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Martin <keine-eile@online.de> - 2018-10-16 10:20 +0200
        Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Jonathan Dowland <jmtd@debian.org> - 2018-10-16 12:00 +0200
          Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Martin <keine-eile@online.de> - 2018-10-16 12:20 +0200
          Re: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied Gene Heskett <gheskett@shentel.net> - 2018-10-16 17:30 +0200
            Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Greg Wooledge <wooledg@eeg.ccf.org> - 2018-10-16 17:40 +0200
              Re: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied Gene Heskett <gheskett@shentel.net> - 2018-10-16 18:20 +0200
              Re: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied Gene Heskett <gheskett@shentel.net> - 2018-10-16 18:30 +0200
                Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied David Wright <deblis@lionunicorn.co.uk> - 2018-10-17 00:50 +0200
      Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-17 06:40 +0200
    Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Reco <recoverym4n@enotuniq.net> - 2018-10-16 09:00 +0200
      Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-17 06:40 +0200
        Re: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied Steve Kemp <skx@debian.org> - 2018-10-17 07:50 +0200
          Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-17 15:30 +0200
        Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Reco <recoverym4n@enotuniq.net> - 2018-10-17 09:00 +0200
          Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-17 15:30 +0200
          Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-18 06:20 +0200
            Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied mick crane <mick.crane@gmail.com> - 2018-10-18 08:10 +0200
              Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied steve <dlist@bluewin.ch> - 2018-10-18 08:20 +0200
                Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied mick crane <mick.crane@gmail.com> - 2018-10-18 08:30 +0200
              Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied mick crane <mick.crane@gmail.com> - 2018-10-18 08:20 +0200
            Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Reco <recoverym4n@enotuniq.net> - 2018-10-18 08:50 +0200
    Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Martin <keine-eile@online.de> - 2018-10-16 10:10 +0200
      Re: apache2: Could not open configuration file  /etc/apache2/apache2.conf: Permission denied Joe <joe@jretrading.com> - 2018-10-16 10:50 +0200

Page 2 of 2 — ← Prev page 1 [2]

#201406

Frommick crane <mick.crane@gmail.com>
Date2018-10-18 08:30 +0200
Message-ID<wK9YJ-2uS-1@gated-at.bofh.it>
In reply to#201404
On 2018-10-18 07:15, steve wrote:
> Le 18-10-2018, à 07:07:34 +0100, mick crane a écrit :
> 
>> On 2018-10-18 05:11, steve wrote:
>> 
>>> 
>>> Still reading on this new thing for me.
>>> 
>>> Thanks
>>> 
>>> Steve
>> 
>> I never came across this apparmor.
>> did you try stopping it with systemctl then see if apache works as 
>> expected ?
> 
> Yes I did and apache failed to start.

does "apachectl configtest" say OK ?

-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#201405

Frommick crane <mick.crane@gmail.com>
Date2018-10-18 08:20 +0200
Message-ID<wK9P4-2rM-7@gated-at.bofh.it>
In reply to#201403
On 2018-10-18 07:07, mick crane wrote:
> On 2018-10-18 05:11, steve wrote:
> 
>> 
>> Still reading on this new thing for me.
>> 
>> Thanks
>> 
>> Steve
> 
> I never came across this apparmor.
> did you try stopping it with systemctl then see if apache works as 
> expected ?

Ah, OK I see you tried that.
Would that not indicate problem is not apparmor ?

mick

-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#201407

FromReco <recoverym4n@enotuniq.net>
Date2018-10-18 08:50 +0200
Message-ID<wKai5-2Bt-1@gated-at.bofh.it>
In reply to#201402
	Hi.

On Thu, Oct 18, 2018 at 06:11:13AM +0200, steve wrote:
> Le 17-10-2018, à 09:52:06 +0300, Reco a écrit :
> 
> > > > And, finally, /var/log/audit/audit.log if you have auditd installed
> > > > (hint - install it if you don't).
> > > 
> > > grep apache /var/log/audit/audit.log
> > > 
> > > type=AVC msg=audit(1539750555.347:76): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/etc/gai.conf" pid=17485 comm="apache2" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
> > > type=SYSCALL msg=audit(1539750555.347:76): arch=c000003e syscall=2 success=no exit=-13 a0=7fe220cac22a a1=80000 a2=1b6 a3=80000 items=0 ppid=17482 pid=17485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apache2" exe="/usr/sbin/apache2" subj==/usr/sbin/apache2 (enforce) key=(null)
> > > type=AVC msg=audit(1539750555.347:77): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/etc/apache2/apache2.conf" pid=17485 comm="apache2" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
> > > type=SYSCALL msg=audit(1539750555.347:77): arch=c000003e syscall=2 success=no exit=-13 a0=7fe2219b6f70 a1=80000 a2=1b6 a3=ffffffffffffff7f items=0 ppid=17482 pid=17485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apache2" exe="/usr/sbin/apache2" subj==/usr/sbin/apache2 (enforce) key=(null)
> > > type=SERVICE_START msg=audit(1539750555.383:78): pid=1 uid=0 auid=4294967295 ses=4294967295 subj==unconfined msg='unit=apache2 comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
> > > 
> > > Seems fine to me.
> > 
> > On the contrary. These show that apache2 binary was denied from reading
> > /etc/gai.conf *and* /etc/apache2/apache2.conf by some Mandatory Access
> > Control (audit record type AVC).
> > Since you're using Debian, I suspect AppArmor.
> > 
> > First things first, Apparmor (and any kind of MAC) is a good thing,
> > especially in your typical server environment. They'll suggest you to
> > disable it - don't. Lowering overall security of your OS is not worth
> > it.
> > 
> > Second, Debian does not provide apparmor profiles for apache. Whatever
> > profile is active in your installation is a result of local
> > misconfiguration.
> > 
> > Third, it's fixable. Install apparmor-utils.
> > Invoke 'aa-complain /usr/sbin/apache2'.
> > Start your apache2 service, stop it and start again.
> > Make some GET/PUT requests to it.
> > Invoke 'aa-logprof' and generate Apparmor profile that's uniquely suited
> > for your environment.
> 
> Here, I get
> 
> Reading log entries from /var/log/audit/audit.log.
> Updating AppArmor profiles in /etc/apparmor.d.
> Target profile exists: /etc/apparmor.d/usr.bin.nvidia-modprobe
> 
> Profile:  libreoffice-soffice
> Execute:  /usr/bin/nvidia-modprobe
> Severity: unknown
> 
> (I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish
>
> What should I be expected to do?

Skip it, of course - Unconfined.
That one's for libreoffice, and you need that dialog showing something for apache.


> Also, aa-status spits out
> 
> apparmor module is loaded.
> 63 profiles are loaded.
...
> 3 processes are in complain mode.
>   /usr/sbin/apache2 (11894)
>   /usr/sbin/apache2 (12019)
>   /usr/sbin/apache2 (12020)
...
> 
> This is rather confusing.

Yet here you have a legitimate Apparmor profile for apache.

> What should I do with this?

Let's try it another way.

pkill -USR1 `pidof auditd`

aa-logprof /usr/sbin/apache2


> > Invoke 'aa-enforce /usr/sbin/apache2', and you're set.
> 
> Profile for /usr/sbin/apache2 not found, skipping
> 
> I guess this is normal since I didn't finish the aa-logprof step.

More or less. aa-status does not lie, your kernel has a profile for
apache.

Reco

[toc] | [prev] | [next] | [standalone]

#201291

FromMartin <keine-eile@online.de>
Date2018-10-16 10:10 +0200
Message-ID<wJsAq-1Jd-9@gated-at.bofh.it>
In reply to#201277
Am 16.10.18 um 07:31 schrieb steve:
> Hi there,
> 
> Purged and then reinstalled apache2 and when I want to start apache2,
> here's what I get:
> 
> # systemctl status apache2.service

What is your 'id'?

> ● apache2.service - The Apache HTTP Server
>   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
>   Active: failed (Result: exit-code) since Tue 2018-10-16 07:22:02 CEST; 13s ago
>  Process: 32122 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)
> 
> oct 16 07:22:01 box systemd[1]: Starting The Apache HTTP Server...
> oct 16 07:22:01 box apachectl[32122]: apache2: Could not open configuration file /etc/apache2/apache2.conf: Permission denied
> oct 16 07:22:02 box apachectl[32122]: Action 'start' failed.
> oct 16 07:22:02 box apachectl[32122]: The Apache error log may have more information.
> oct 16 07:22:02 box systemd[1]: apache2.service: Control process exited, code=exited status=1
> oct 16 07:22:02 box systemd[1]: apache2.service: Failed with result 'exit-code'.
> oct 16 07:22:02 box systemd[1]: Failed to start The Apache HTTP Server.

Do you have any SSLCertificateKeyFile configured? Check permissions first, as a normal user can not read those.
 
> 
> ls -l /etc/apache2/apache2.conf
> -rw-r--r-- 1 root root 7224 jun  2 10:01 /etc/apache2/apache2.conf
> 
> 
> Getting nuts.
> 
> Any ideas?
> 
> Thanks
>

[toc] | [prev] | [next] | [standalone]

#201294

FromJoe <joe@jretrading.com>
Date2018-10-16 10:50 +0200
Message-ID<wJtd8-1VM-5@gated-at.bofh.it>
In reply to#201291
On Tue, 16 Oct 2018 10:06:39 +0200
Martin <keine-eile@online.de> wrote:

> Am 16.10.18 um 07:31 schrieb steve:
> > Hi there,
> > 
> > Purged and then reinstalled apache2 and when I want to start
> > apache2, here's what I get:
> > 
> > # systemctl status apache2.service  
> 
> What is your 'id'?
> 
> > ● apache2.service - The Apache HTTP Server
> >   Loaded: loaded (/lib/systemd/system/apache2.service; enabled;
> > vendor preset: enabled) Active: failed (Result: exit-code) since
> > Tue 2018-10-16 07:22:02 CEST; 13s ago Process: 32122
> > ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)
> > 
> > oct 16 07:22:01 box systemd[1]: Starting The Apache HTTP Server...
> > oct 16 07:22:01 box apachectl[32122]: apache2: Could not open
> > configuration file /etc/apache2/apache2.conf: Permission denied oct
> > 16 07:22:02 box apachectl[32122]: Action 'start' failed. oct 16
> > 07:22:02 box apachectl[32122]: The Apache error log may have more
> > information. oct 16 07:22:02 box systemd[1]: apache2.service:
> > Control process exited, code=exited status=1 oct 16 07:22:02 box
> > systemd[1]: apache2.service: Failed with result 'exit-code'. oct 16
> > 07:22:02 box systemd[1]: Failed to start The Apache HTTP Server.  
> 
> Do you have any SSLCertificateKeyFile configured? Check permissions
> first, as a normal user can not read those. 
> > 
> > ls -l /etc/apache2/apache2.conf
> > -rw-r--r-- 1 root root 7224 jun  2 10:01 /etc/apache2/apache2.conf

Surely apache2 starts up as root, in order to obtain port 80, and then
drops privilege to www-data? It must read the configuration files while
root, or else it wouldn't know which port(s) it should request.

-- 
Joe

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web