[solved] nginx chroot jail: open() "/run/nginx.pid" Permission denied

I used the perl script from the nginx wiki to configure chroot jail and also configured the nginx systemd unit file. When I try to start the service I get
# systemctl start nginx
Job for nginx.service failed. See 'systemctl status nginx.service' and 'journalctl -xn' for details.
# systemctl status nginx.service
nginx.service - A high performance web server and a reverse proxy server in chroot jail
Loaded: loaded (/etc/systemd/system/nginx.service; enabled)
Active: failed (Result: exit-code) since tis 2013-05-07 20:58:49 CEST; 4s ago
Process: 418 ExecStartPre=/usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -t -q -g pid /run/nginx.pid; daemon on; master_process on; (code=exited
, status=1/FAILURE)
Executing the ExecStartPre line produces the open error.
# /usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -t -q -g 'pid /run/nginx.pid; daemon on; master_process on;'
nginx: [emerg] open() "/run/nginx.pid" failed (13: Permission denied)
What could be causing this?
Here's my nginx.service
# cat /etc/systemd/system/nginx.service
[Unit]
Description=A high performance web server and a reverse proxy server in chroot jail
After=syslog.target network.target
[Service]
Type=forking
PIDFile=/srv/http/run/nginx.pid
ExecStartPre=/usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -t -q -g 'pid /run/nginx.pid; daemon on; master_process on;'
ExecStart=/usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -g 'pid /run/nginx.pid; daemon on; master_process on;'
ExecReload=/usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -g 'pid /run/nginx.pid; daemon on; master_process on;' -s reload
ExecStop=/usr/bin/chroot --userspec=http:http /srv/http /usr/sbin/nginx -g 'pid /run/nginx.pid;' -s quit
[Install]
WantedBy=multi-user.target
/srv/http/run
# ls -ahl /srv/http/run/
totalt 8,0K
drwxr-xr-x 2 root root 4,0K 7 maj 20.53 ./
dr-x--x--x 9 root root 4,0K 7 maj 20.16 ../
-rw-r--r-- 1 root root 0 7 maj 20.53 nginx.pid
edit:
# chroot --userspec http:http /srv/http /usr/sbin/nginx
nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)
I tried to change the port to 8080 and got
# chroot --userspec http:http /srv/http /usr/sbin/nginx
nginx: [emerg] open("/dev/null") failed (13: Permission denied)
solution:
The problem was due to the partition being mounted nodev,nosuid.
Last edited by seron (2013-05-08 11:25:12)

I know this post is quite old but I wanted to say thank you to the author that you posted this solution. THANKS!!!

Similar Messages

%Error opening nvram:/startup-config (Permission denied)

I'm getting an odd error, permission denied trying to issue "show config" at user level. We use this throughout the environment with no issues.
IOS: System image file is "flash0:c2900-universalk9-mz.SPA.152-3.T.bin"
R1#sh run | i aaa
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting commands 15 default stop-only group tacacs+
aaa session-id common
R1#sh run | i priv
privilege exec level 1 traceroute
privilege exec level 1 ping
privilege exec level 1 show logging
privilege exec level 1 show configuration
privilege exec level 1 show privilege
privilege exec level 1 show
R1#disable
R1>show config
Using 11855 out of 262136 bytes
%Error opening nvram:/startup-config (Permission denied)

You are indeed allowed to run the command (as evidenced by the fact that the command did run).
show config is effectively an alias for the command more nvram:startup-config
As a result, the issue is the permission on the file, not the command itself.
Unfortunately, the file systems do not explicitly support permissions. This used to be implicitly supported through permissions on show config.
Perhaps this is a bug. I'd open a case on this if you need really need this feature.

My error postalias: fatal: open /etc/aliases.db: Permission denied

I updated my postfix aliases saved it then exited out. Entered newaliases and this is the error that i got. Logged in as super user. As far as I know nothing else has changed. Please help

Perhaps you have accidentally set the uchg flag, or perhaps your permissions are wrong. Should be:
mail:/etc admin$ ls -alo /private/etc/aliases.db
-rw-r--r-- 1 root wheel - 16384 Oct 11 2005 /private/etc/aliases.db
Russ
Xserve G5 2.0 GHz 2 GB RAM Mac OS X (10.4.8) Apple Hardware RAID, ATTO UL4D, Exabyte VXA-2 1x10 1u

"Error opening document - permission denied"

I'm using Acrobat Reader version 7.0. It refused to open pdf files on my computer. The error message that was returned is There was an error opening this document. Permission denied. I own the files, with read (and write) permissions, and acroread is running with my user id.
I have tried deleting and re-installing the program, with no luck.
Any ideas, please?

I'm using Acrobat Reader version 7.0.
Install the updates for Adobe Reader 7.

Startx: xf86OpenConsole: Cannot Open /dev/tty0 (Permission Denied)

running startx as normal user gives me the following error:
xf86OpenConsole: Cannot Open /dev/tty0 (Permission Denied)
it seems to run ok as root... but I obviously don't want to be doing that all the time. I guess that means its a permission issue, but what, where, when and how?
I searched the forums and found one article from last year with similar errors after an updated Xorg package, apparently that was fixed and it gave me no insight as to how to manually fix this error.
I'm just starting with Arch and its my first 'advanced' distro (been mostly running ubuntu up until now)... hence, I've never had to set up Xorg etc before.

$ groups
users
$ls -l /dev/tty0
lrwxrwxrwx 1 root root 4 2007-10-17 08:54 /dev/tty0 -> vc/0
I've already tried adding the group 'users' to /dev/tty0 but when I restart it just goes back to 'root'
When I do add the group 'users', it seems to get past the problem with /dev/tty0 and it gives me this error:
xf86OpenConsole: Cannot open virtual console 7 (Permission Denied)

Failed to read PID from file /run/nginx.pid: Invalid argument

Hi,
tried to get an nginx server running to set up an owncloud environment.
When starting the nginx server
$ systemctl start nginx.service
I get the message: "Failed to read PID from file /run/nginx.pid: Invalid argument"
[root@klaus /etc/nginx]# systemctl status nginx
nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled)
Active: active (running) since Sat 2013-10-12 17:50:46 CEST; 8min ago
Process: 1823 ExecStart=/usr/bin/nginx -g pid /run/nginx.pid; daemon on; master_process on; (code=exited, status=0/SUCCESS)
Process: 1821 ExecStartPre=/usr/bin/nginx -t -q -g pid /run/nginx.pid; daemon on; master_process on; (code=exited, status=0/SUCCESS)
Main PID: 1825 (nginx)
CGroup: /system.slice/nginx.service
├─1825 nginx: master process /usr/bin/nginx -g pid /run/nginx.pid; daemon on; master_process on;
└─1826 nginx: worker process
Oct 12 17:50:46 klaus systemd[1]: Failed to read PID from file /run/nginx.pid: Invalid argument
Oct 12 17:50:46 klaus systemd[1]: Started A high performance web server and a reverse proxy server.
but /run/nginx.pid is readable:
# cat /run/nginx.pid
2058
# ll /run/nginx.pid
-rw-r--r-- 1 root root 4 Oct 12 17:39 /run/nginx.pid
It seems nginx is runnung thought but in my browser I only get a blank page.
Any help appreciated.
Last edited by wombalton (2013-10-13 14:17:46)

Actually it's the first time I tried to set up one.
I Basically followed this guide [1] adopting it to arch.
That's where i got my nginx.conf from. Taking the standard nginx.conf that comes by install and replacing the server part.
After some searching I found the owncloud manual[2] with an example nginx.conf. Comparing that with my one I found some differences. Applying them works out fine.
I get now the owncloud page.
The systemd error still ocurs, but I think it does not matter to run the server.
Thanks for your help.
[1] https://docs.google.com/file/d/0B0ZsTQd … ring&pli=1
[2] http://doc.owncloud.org/server/5.0/admi … figuration
EDIT:
Just in case someone stumbles over this and tries to use the config:
This one [3] really works
[3] http://doc.owncloud.org/server/5.0/admi … thers.html
Last edited by wombalton (2013-10-14 13:31:22)

Chroot-jail password problem

I've got a running chroot-jail to allow semi-trusted users ssh-access to my webhosting server. The problem is that they can't change their passwords because `passwd` can't access files outside the chroot-jail (as it's suppose to be). I've read about someone solving this using nsswitch.conf and some sort of setup to make it possible for the users to change their passwords.
The question is basically, how do I get around this problem, making it possible for the logged in users to change their own password?

Oh what a tangled web we weave. I read up on keychain and I don't understand what I'm reading. Right now I cannot download my email on my computer, I can access it through the cloud. I'm sure it will be the same for the other iCloud feathers. When I go to preferences and select iCloud when ever I try to sign in I get some dialog box it shows up "A keychain cannot be found to store 1076701306. It doesn't matter whether I reset it or cancel it out iCloud preferences remains grayed out.
In keychain access on the left side under keychains and Read's local item, systems, and systems roots.
When I select local items nothing shows up to the right under the name column even when down under all items is selected nothing shows up. And nothing shows up to the right when under categories I selected the other options password etc. On the other hand when I select under keychains systems, systems roots I do get items to show up on the right side under names under all items, passwords, etc. Where do I start?

Can I run two PIDs from the same vi?

Hi
I want to control speed of the rotating shaft and force applied by the pneumatic cylinder using two different PIDs from the same program.
I managed to get two PIDs to work separatly using PID control loop VI`s supplied with labview 6.1 (I got Kc, I and D right, so there is no overshoot). When I try to run both PIDs within my vi they don`t work. I again tried various gains and managed to get one PID to work but not the other. Then through trial and error I managed to get a second PID to work but I had to change refresh time of the FOR loop from 100msec to 1msec.
Does anyone have experience with running two PIDs in the same program? Does the timing of the FOR loop influence PID contorller? Does equiring of other data while run
ning PID has effect on the PID?
I would really appreciate any comments/help. I am pretty thrustrated at this time
Thanks"

The timing of the FOR loop will influence your PID control, which is a fundamental part of PID control. Acquiring data doesn't affect the PID although it could affect the timing of the loops. For instance if you only have one DAQ card you would want to have it all in one loop because you can not have two AI sessions open to the same card.
For more detailed information on PID I would recommend reading the "PID Control Toolset
User Manual" which should have been installed to your machine but can also be found at : PID Control Toolset User Manual"
Regards,
JR A.
Application Engineer
National Instruments

Can i run two PIDs at the same time?

Hi
I want to control speed of the rotating shaft and force applied by the pneumatic cylinder using two different PIDs from the same program.
I managed to get two PIDs to work separatly using PID control loop VI`s supplied with labview 6.1 (I got Kc, I and D right, so there is no overshoot). When I try to run both PIDs within my vi they don`t work. I again tried various gains and managed to get one PID to work but not the other. Then through trial and error I managed to get a second PID to work but I had to change refresh time of the FOR loop from 100msec to 1msec.
Does anyone have experience with running two PIDs in the same program? Does the timing of the FOR loop influence PID contorller? Does equiring of other data while
running PID has effect on the PID?
I would really appreciate any comments/help. I am pretty thrustrated at this time
Thanks

I don't know whcih PID vi's you are using but I had similar problems. I
solved it by going to the VI properties of the PID subvi, select category
execution and make sure that reentrant execution is selected. Only then two
instances of the PID vi can run without interfering each other.
Martien
solved by setting the execution mode
"smartlander" wrote in message
news:[email protected]..
> Hi
>
> I want to control speed of the rotating shaft and force applied by the
> pneumatic cylinder using two different PIDs from the same program.
> I managed to get two PIDs to work separatly using PID control loop
> VI`s supplied with labview 6.1 (I got Kc, I and D right, so there is
> no overshoot). When I try to run
both PIDs within my vi they don`t
> work. I again tried various gains and managed to get one PID to work
> but not the other. Then through trial and error I managed to get a
> second PID to work but I had to change refresh time of the FOR loop
> from 100msec to 1msec.
> Does anyone have experience with running two PIDs in the same program?
> Does the timing of the FOR loop influence PID contorller? Does
> equiring of other data while running PID has effect on the PID?
> I would really appreciate any comments/help. I am pretty thrustrated
> at this time
> Thanks

How to solve the problem when opening program illustrator cs6 ERROR: 16 It is WINDOWS 8.1 / 64 BIT help please

how to solve the problem when opening program illustrator cs6
ERROR: 16
It is WINDOWS 8.1 / 64 BIT
help please

Thanks, Jeff! The file Adobe Setup Error.log contains the following information:
02/14/14 07:20:26:474 | [INFO] | | OOBE | DE | | | | 8860 | DEVersion: 5.0.0.0
02/14/14 07:20:26:475 | [INFO] | | OOBE | DE | | | | 8860 | Loading library from C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DECore\DE5\Setup.dll
[    8860] Fri Feb 14 07:20:26 2014 INFO
::START TIMER:: [Total Timer]
CHECK: Single instance running
CHECK : Credentials
Load Deployment File
CHECK : Another Native OS installer already running
Create Required Folders
Assuming uninstall mode
Lookup for master payload
[    8860] Fri Feb 14 07:20:26 2014 ERROR
DW040: The product "{893B3B44-0A1E-404B-8FE8-0A74509102A9}" is not installed. Cannot proceed with the uninstall
[    8860] Fri Feb 14 07:20:26 2014 INFO
:: END TIMER :: [Total Timer] took 6.90443 milliseconds (0.00690443 seconds) DTR = 579.338 KBPS (0.56576 MBPS)
-------------------------------------- Summary --------------------------------------
- 0 fatal error(s), 1 error(s), 0 warning(s)
ERROR: DW040: The product "{893B3B44-0A1E-404B-8FE8-0A74509102A9}" is not installed. Cannot proceed with the uninstall
Please search the above error/warning string(s) to find when the error occurred.
These errors resulted in installer Exit Code mentioned below.
Exit Code: 33 - The product is not installed, cannot uninstall.
Please see specific errors and warnings for troubleshooting. For example, ERROR: DW040 ...

Chroot jail in FTP?

I asked this question about two years back, but I'm hoping there's an
answer now...
Is there a way to lock ftp clients into their home directory, so that
cannot go back a directory level? Essentially their home directory is
their root directory.
Previously using linux ftp servers, you could do this with an option
called 'chroot jail', but I'm not seeming the same feature on the
Netware ftp.
Is there a way to do this? I'm running NW 6.5sp6.
Thanks!
Matt

Did you check the date of the TID though ? <g>, I'm surprised no one
pointed it out last time you asked
Cheers Dave
Dave Parkes [NSCS]
Occasionally resident at http://support-forums.novell.com/

About chroot jails and ACL

I want to run rtorrent in a chroot jail. Correct me if wrong, but jailing rtorrent would consume much more RAM cause rtorrent will not use libraries that it needs and may be already in memory.
So I wonder, why people just don't create a new user, install ACL, block everything to that user but read access to /lib and some config files, and execute permission to only the needed binaries. It would be easy to do since as I understand if you block all /bin permissions to the restricted user, all future files there will inherit those permissions. The only problem I see is that if you update, you will have to set some permissions again, easily fixed with a script. ACL seems much more easier to setup than chroot jails!
When you run rtorrent under that restricted user, even if rtorrent is exploited, the attacker will not be able to do much, as ACL will not let him execute but basic commands.
So, why is it that people seem to prefer chroot jails? Does installing ACL has some kind of performance penalty?

_Mike_ wrote:Does installing ACL has some kind of performance penalty?
Do you mean Mandatory Access Control? Filesystem ACL is already installed on every Linux system.
When you run rtorrent under that restricted user, even if rtorrent is exploited, the attacker will not be able to do much, as ACL will not let him execute but basic commands.
Chroot jails were not created to be used as a security tool and are very easy to break out of. Filesystem ACL is very limited in scope and also provides little security.
You might want to look into using Mandatory Access Control (MAC) which is available with TOMOYO Linux, AppArmor, SELinux or SMACK. SELinux is the most powerful, but will take a long time to master. TOMOYO Linux is easier to use and the relevant packages are already in [community]. See the wiki page for more information.
All MAC implementations have a small degree of performance penalty. SELinux probably has the greatest penalty, but overall you probably won't notice anything with any of the implementations.
Last edited by jnguyen (2011-04-13 06:48:36)

[SOLVED] XFCE4 Will Not Open When Logged On as Regular User

Please excuse me if I am being a noob, but I only installed ArchLinux yesterday. Whenever I run
startxfce4
as a regular user, the screen goes dark, flashes the Nvidia logo, then exits to a dialog box that reads:
Unable to load a failsafe session Unable to determine failsafe session name. Possible causes: xfconfd isn't running (D-bus setup problem); environment variable $XDG_CONFIG_DIRS is set incorrectly (msut include "/etc"), or xfce4-session is installed incorrectly."
When I check the output after I click "Quit" on the dialog box, the output at the end reads
gpg-agent[1538]:error creating '/home/mordecai/.cache/gpg-agent-info' : Permission denied (xfce4-session:1515): Pango-WARNING **:error opening config file '/home/mordecai/.config/pango/pangorc' : Permission denied
However, when I run
startxfce4
logged on as root, everything opens fine. Thanks for any help and/or pointers.
Last edited by mordecaifeilbach (2012-11-03 21:51:33)

Also, when I try to start xfconfd it gives me this:
$ /usr/lib/xfce4/xfconf/xfconfd
(xfconfd:20910: xfconfd-CRITICAL **: Xfconfd failed to start: Unable to autolaunch a dbus-daemon without a $DISPLAY for X11
I also checked the environment variable $XDG-CONFIG-DIRS and it is set correctly, and the xfce4-session installation did not return any error messages.

How to solve problem - " Safari cannot open page because it isn't connected to the internet" but the airport is ok. signal full and i have n IP address.

How to solve problem - " Safari cannot open page because it isn't connected to the internet" but the airport is ok. signal full and i have n IP address. and i m using Macbook pro.
OS snow leopard and above...

Do you have this problem with all websites, or only some? If only some, which ones?

Trying a recovery from a livedisc and chroot fails to run /bin/bash?!?

The title pretty much says it all.
Trying to do a repair on my daughter's laptop, booting from a live image on USB. It's an old eeepc with only 1 partition, all on sda1.
I'm using the Kernel Panics wiki like I usually do when I have to go through this: ( https://wiki.archlinux.org/index.php/Kernel_panic) but when I try to chroot, I get this:
chroot: failed to run comman '/bin/bash': No such file or directory
Any ideas? I'm pulling my hair out here.

Ah, maybe you're trying to use a 64-bit binaries from the USB on a 32-bit system or vice-versa.
Last edited by karol (2010-12-15 18:28:42)

[solved] nginx chroot jail: open() "/run/nginx.pid" Permission denied

Similar Messages

Maybe you are looking for