[ckan-dev] Premature end of script headers when using ckanext-spatial

Fri Oct 18 16:26:40 UTC 2013

Hi,

Answering myself, in case someone else arrives here with the same problem.
To fix the issue, I used "sealert" from the "setroubleshoot" package. It
parses SELinux's audit.log, and explains what's going on, and what you
should do if you want to allow something that was denied.

>From that, I figured out that I needed to allow "httpd_execmem" using
"setsebool -P httpd_execmem 1".

Now everything is working fine.

Cheers!

2013/10/17 Vitor Baptista <vitor at vitorbaptista.com>

> Hi,
>
> I figured out that SELinux is the culprit. If I disable it, everything
> goes on fine. I tried following the instructions at
> https://github.com/okfn/ckan/wiki/How-to-Install-CKAN-2.0-on-CentOS-6.3#adjust-the-selinux-file-contexts,
> but that didn't work.
>
> Looking at dmesg, I got:
>
> type=1400 audit(1382056990.260:30750): avc:  denied  { execmem } for
>>  pid=13011 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0
>> tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
>> httpd[13011] general protection ip:7fb21cca3bbd sp:7fb229fd4320 error:0
>> in _ctypes.so[7fb21cc95000+1a000]
>
>
> So there was an execmem that was denied. But what now? How to give httpd
> permissions?
>
> Cheers,
>
>
> 2013/10/11 Vitor Baptista <vitor at vitorbaptista.com>
>
>> Hi Adrià,
>>
>> That runs without problems, and if I'm able to run the server with paster
>> as well, so the extension should be installed correctly. It's only when I
>> try with Apache that I get that error.
>>
>> Do you have any other ideas of the possible culprit?
>>
>> Cheers,
>>
>>
>> 2013/10/11 Adrià Mercader <adria.mercader at okfn.org>
>>
>>> Hi Vitor,
>>>
>>> I've never use the spatial extension on RHEL so not sure what might be
>>> wrong. Have you tried running a command on paster (not via Apache)?
>>>
>>> Something like this on your virtualenv for instance:
>>>
>>> (pyenv) $ paster --plugin=ckanext-spatial spatial initdb
>>> --config=/etc/ckan/default.ini
>>>
>>> Perhaps that gives us more clues
>>>
>>> Adrià
>>>
>>> On 11 October 2013 00:09, Vitor Baptista <vitor at vitorbaptista.com>
>>> wrote:
>>> > Hi all,
>>> >
>>> > I'm trying to install ckanext-spatial on a RHEL6, but I'm getting some
>>> > strange errors.
>>> >
>>> > I was able to configure PostGIS and it seems to be working fine on the
>>> DB
>>> > server. I've also installed ckanext-spatial and all of its
>>> dependencies on
>>> > the app server just fine, but whenever I add spatial_metadata or
>>> > spatial_query to the plugins list, I get:
>>> >
>>> >> ==> /var/log/httpd/ckan_default.error.log <==
>>> >> [Fri Oct 11 00:00:02 2013] [error]
>>> >> /usr/lib/python2.6/site-packages/tw/core/view.py:223:
>>> DeprecationWarning:
>>> >> object.__new__() takes no parameters
>>> >> [Fri Oct 11 00:00:02 2013] [error]   obj = object.__new__(cls, *args,
>>> >> **kw)
>>> >> [Fri Oct 11 00:00:03 2013] [error] [client 187.114.201.223] Premature
>>> end
>>> >> of script headers: apache.wsgi
>>> >
>>> >
>>> >> ==> /var/log/httpd/error_log <==
>>> >> [Fri Oct 11 00:00:04 2013] [notice] child pid 4135 exit signal
>>> >> Segmentation fault (11)
>>> >
>>> >
>>> > Googling around, it seems that it happens when somehow Apache is
>>> running one
>>> > version of a library, and your Python code is running another. I tried
>>> > looking for possible culprits, but couldn't find any. The closest I
>>> thought
>>> > was geos that, as I installed this version:
>>> >
>>> >> geos.x86_64                        3.3.2-1.el6             @epel
>>> >
>>> >
>>> > Running just geojson_preview works fine.
>>> >
>>> > Any ideas?
>>> >
>>> > Cheers,
>>> >
>>> > --
>>> >
>>> > Vítor Baptista
>>> >
>>> > Developer  |  http://vitorbaptista.com | LinkedIn | @vitorbaptista
>>> >
>>> > The Open Knowledge Foundation
>>> >
>>> > Empowering through Open Knowledge
>>> >
>>> > http://okfn.org/  |  @okfn  |  OKF on Facebook  |  Blog  |  Newsletter
>>> >
>>> >
>>> > _______________________________________________
>>> > ckan-dev mailing list
>>> > ckan-dev at lists.okfn.org
>>> > http://lists.okfn.org/mailman/listinfo/ckan-dev
>>> > Unsubscribe: http://lists.okfn.org/mailman/options/ckan-dev
>>> >
>>>
>>> _______________________________________________
>>> ckan-dev mailing list
>>> ckan-dev at lists.okfn.org
>>> http://lists.okfn.org/mailman/listinfo/ckan-dev
>>> Unsubscribe: http://lists.okfn.org/mailman/options/ckan-dev
>>>
>>
>>
>>
>> --
>>
>> Vítor Baptista
>>
>> Developer  |  http://vitorbaptista.com | LinkedIn<http://www.linkedin.com/in/vitorbaptista>|
>> @vitorbaptista <http://twitter.com/vitorbaptista>
>>
>> The Open Knowledge Foundation <http://okfn.org>
>>
>> *Empowering through Open Knowledge*
>>
>> http://okfn.org/  |  @okfn <http://twitter.com/okfn>  |  OKF on Facebook<https://www.facebook.com/OKFNetwork> |
>> Blog <http://blog.okfn.org/>  |  Newsletter<http://okfn.org/about/newsletter/>
>>
>>
>
>
> --
>
> Vítor Baptista
>
> Developer  |  http://vitorbaptista.com | LinkedIn<http://www.linkedin.com/in/vitorbaptista>|
> @vitorbaptista <http://twitter.com/vitorbaptista>
>
> The Open Knowledge Foundation <http://okfn.org>
>
> *Empowering through Open Knowledge*
>
> http://okfn.org/  |  @okfn <http://twitter.com/okfn>  |  OKF on Facebook<https://www.facebook.com/OKFNetwork> |
> Blog <http://blog.okfn.org/>  |  Newsletter<http://okfn.org/about/newsletter/>
>
>

-- 

Vítor Baptista

Developer  |  http://vitorbaptista.com |
LinkedIn<http://www.linkedin.com/in/vitorbaptista>|
@vitorbaptista <http://twitter.com/vitorbaptista>

The Open Knowledge Foundation <http://okfn.org>

*Empowering through Open Knowledge*

http://okfn.org/  |  @okfn <http://twitter.com/okfn>  |  OKF on
Facebook<https://www.facebook.com/OKFNetwork> |
Blog <http://blog.okfn.org/>  |  Newsletter<http://okfn.org/about/newsletter/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/ckan-dev/attachments/20131018/22dc0f24/attachment-0001.html>