[ckan-dev] Premature end of script headers when using ckanext-spatial

Mon Oct 21 11:53:14 UTC 2013

Hi Vitor,
That is some serious debugging! Glad you got around it, hopefully it
can be helpful for someone in the future.
Is it worth adding a note on the wiki page that you mentioned?

Cheers,

Adrià

On 18 October 2013 17:26, Vitor Baptista <vitor at vitorbaptista.com> wrote:
> Hi,
>
> Answering myself, in case someone else arrives here with the same problem.
> To fix the issue, I used "sealert" from the "setroubleshoot" package. It
> parses SELinux's audit.log, and explains what's going on, and what you
> should do if you want to allow something that was denied.
>
> From that, I figured out that I needed to allow "httpd_execmem" using
> "setsebool -P httpd_execmem 1".
>
> Now everything is working fine.
>
> Cheers!
>
>
> 2013/10/17 Vitor Baptista <vitor at vitorbaptista.com>
>>
>> Hi,
>>
>> I figured out that SELinux is the culprit. If I disable it, everything
>> goes on fine. I tried following the instructions at
>> https://github.com/okfn/ckan/wiki/How-to-Install-CKAN-2.0-on-CentOS-6.3#adjust-the-selinux-file-contexts,
>> but that didn't work.
>>
>> Looking at dmesg, I got:
>>
>>> type=1400 audit(1382056990.260:30750): avc:  denied  { execmem } for
>>> pid=13011 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0
>>> tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
>>> httpd[13011] general protection ip:7fb21cca3bbd sp:7fb229fd4320 error:0
>>> in _ctypes.so[7fb21cc95000+1a000]
>>
>>
>> So there was an execmem that was denied. But what now? How to give httpd
>> permissions?
>>
>> Cheers,
>>
>>
>> 2013/10/11 Vitor Baptista <vitor at vitorbaptista.com>
>>>
>>> Hi Adrià,
>>>
>>> That runs without problems, and if I'm able to run the server with paster
>>> as well, so the extension should be installed correctly. It's only when I
>>> try with Apache that I get that error.
>>>
>>> Do you have any other ideas of the possible culprit?
>>>
>>> Cheers,
>>>
>>>
>>> 2013/10/11 Adrià Mercader <adria.mercader at okfn.org>
>>>>
>>>> Hi Vitor,
>>>>
>>>> I've never use the spatial extension on RHEL so not sure what might be
>>>> wrong. Have you tried running a command on paster (not via Apache)?
>>>>
>>>> Something like this on your virtualenv for instance:
>>>>
>>>> (pyenv) $ paster --plugin=ckanext-spatial spatial initdb
>>>> --config=/etc/ckan/default.ini
>>>>
>>>> Perhaps that gives us more clues
>>>>
>>>> Adrià
>>>>
>>>> On 11 October 2013 00:09, Vitor Baptista <vitor at vitorbaptista.com>
>>>> wrote:
>>>> > Hi all,
>>>> >
>>>> > I'm trying to install ckanext-spatial on a RHEL6, but I'm getting some
>>>> > strange errors.
>>>> >
>>>> > I was able to configure PostGIS and it seems to be working fine on the
>>>> > DB
>>>> > server. I've also installed ckanext-spatial and all of its
>>>> > dependencies on
>>>> > the app server just fine, but whenever I add spatial_metadata or
>>>> > spatial_query to the plugins list, I get:
>>>> >
>>>> >> ==> /var/log/httpd/ckan_default.error.log <==
>>>> >> [Fri Oct 11 00:00:02 2013] [error]
>>>> >> /usr/lib/python2.6/site-packages/tw/core/view.py:223:
>>>> >> DeprecationWarning:
>>>> >> object.__new__() takes no parameters
>>>> >> [Fri Oct 11 00:00:02 2013] [error]   obj = object.__new__(cls, *args,
>>>> >> **kw)
>>>> >> [Fri Oct 11 00:00:03 2013] [error] [client 187.114.201.223] Premature
>>>> >> end
>>>> >> of script headers: apache.wsgi
>>>> >
>>>> >
>>>> >> ==> /var/log/httpd/error_log <==
>>>> >> [Fri Oct 11 00:00:04 2013] [notice] child pid 4135 exit signal
>>>> >> Segmentation fault (11)
>>>> >
>>>> >
>>>> > Googling around, it seems that it happens when somehow Apache is
>>>> > running one
>>>> > version of a library, and your Python code is running another. I tried
>>>> > looking for possible culprits, but couldn't find any. The closest I
>>>> > thought
>>>> > was geos that, as I installed this version:
>>>> >
>>>> >> geos.x86_64                        3.3.2-1.el6             @epel
>>>> >
>>>> >
>>>> > Running just geojson_preview works fine.
>>>> >
>>>> > Any ideas?
>>>> >
>>>> > Cheers,
>>>> >
>>>> > --
>>>> >
>>>> > Vítor Baptista
>>>> >
>>>> > Developer  |  http://vitorbaptista.com | LinkedIn | @vitorbaptista
>>>> >
>>>> > The Open Knowledge Foundation
>>>> >
>>>> > Empowering through Open Knowledge
>>>> >
>>>> > http://okfn.org/  |  @okfn  |  OKF on Facebook  |  Blog  |  Newsletter
>>>> >
>>>> >
>>>> > _______________________________________________
>>>> > ckan-dev mailing list
>>>> > ckan-dev at lists.okfn.org
>>>> > http://lists.okfn.org/mailman/listinfo/ckan-dev
>>>> > Unsubscribe: http://lists.okfn.org/mailman/options/ckan-dev
>>>> >
>>>>
>>>> _______________________________________________
>>>> ckan-dev mailing list
>>>> ckan-dev at lists.okfn.org
>>>> http://lists.okfn.org/mailman/listinfo/ckan-dev
>>>> Unsubscribe: http://lists.okfn.org/mailman/options/ckan-dev
>>>
>>>
>>>
>>>
>>> --
>>>
>>> Vítor Baptista
>>>
>>> Developer  |  http://vitorbaptista.com | LinkedIn | @vitorbaptista
>>>
>>> The Open Knowledge Foundation
>>>
>>> Empowering through Open Knowledge
>>>
>>> http://okfn.org/  |  @okfn  |  OKF on Facebook  |  Blog  |  Newsletter
>>
>>
>>
>>
>> --
>>
>> Vítor Baptista
>>
>> Developer  |  http://vitorbaptista.com | LinkedIn | @vitorbaptista
>>
>> The Open Knowledge Foundation
>>
>> Empowering through Open Knowledge
>>
>> http://okfn.org/  |  @okfn  |  OKF on Facebook  |  Blog  |  Newsletter
>
>
>
>
> --
>
> Vítor Baptista
>
> Developer  |  http://vitorbaptista.com | LinkedIn | @vitorbaptista
>
> The Open Knowledge Foundation
>
> Empowering through Open Knowledge
>
> http://okfn.org/  |  @okfn  |  OKF on Facebook  |  Blog  |  Newsletter
>
>
> _______________________________________________
> ckan-dev mailing list
> ckan-dev at lists.okfn.org
> http://lists.okfn.org/mailman/listinfo/ckan-dev
> Unsubscribe: http://lists.okfn.org/mailman/options/ckan-dev
>