CODEWITHSUNDEEP
pythonpermissionsapache2cgiexec
NMSD
NMSD

Reputation: 494

Python exec() Permission Denied in Apache server: /cgi_bin/*.py

I have 2 python env in my server. One path is /usr/bin and other one is the anaconda path as shown below. I am getting Permission denied error when I try executing a basic Python script on my Apache server. The python interpreter path in my .py file is as follows

#!/home/cloudera/anaconda3/bin

When this path is used, the apache server shows the error as shown below:

(13)Permission denied: exec of '/var/www/cgi-bin/abc.py' failed, referer:

When my python interpreter path in .py is changed to i.e #!/usr/bin it works well.

The problem is I have installed all my packages in /home/cloudera/anaconda3/bin

I tried setting this path to be accessible to execute in apache server by adding the below line of code in /etc/httpd/conf/httpd.conf file as follows

  <Directory "/home/cloudera/anaconda3/bin/">
    AllowOverride None
    Options ExecCGI
    AddHandler cgi-script .py
    #None
    Order allow,deny
    Allow from all
</Directory>

I still get Permission Denied. It still does not work. I am new to cgi, any help would be really grateful. Thanks in advance.

Upvotes: 2

Views: 2732

Answers (1)

Ondrej K.
Ondrej K.

Reputation: 9664

Admittedly I've completely missed the fact that the interpret was specified as directory and the actual binary file as pointed out by Jean-François Fabre. That would indeed cause the same error. But since the OP fixed that and still got the same error, I am undeleting the answer extended as requested.

Also come to think of it, it may be more of a Server Fault question as it would appear.

This error (13: EACCES) is raised by and propagated from the OS.

HTTPd servers usually employ privilege separation and once bound to a reserved port drop their EUID to an unprivileged user. Usually a dedicate one or nobody (on my system it would be user apache, group apache). You should be able to find these in your httpd.conf under User and Group resp.

Make sure this user has access and can execute the binary you're calling.

Give you've fixed the interpreted (and the file would execute on its own). Go find your httpd.conf file (I think different distros may package it differently, on mine it would reside here: /etc/httpd/httpd.conf). You will find User and Group entries there. You must be able to access and execute the script (incl. the interpreter) as this user, because that's how Apache will try to call it. I.e. this user (or group) must be able to access this file (along the complete path) and execute it. If for instance /home/cloudera/ us restricted to (0700: rwx------) and owned by user other then the one listed int your httpd.conf (very likely), OS would prevent your Apache user to access and execute the file resulting in EACCES error you are seeing. The easiest might be to become that user and see how far your access goes, but you'd need to temporarily tweak few bits for that as the Apache account likely is locked and has not shell set (or rather /bin/false as shell).

One more thing, but I hope it's not as obvious as that. The corresponding user must have execute permission on the script itself.

Upvotes: 1

Related Questions