Segmentation fault in mod_neko, Fedora Core 8

Hello all,

  I was just trying to set up neko in a Fedora Core 8 and
got
  Segmentation Fault error when starting Apache with
mod_neko2 loaded.
  I've tried both 1.6.0 and 1.6.1 from CVS - same problem.
Without
  mod_neko, Apache runs fine..

  The exact error message looks like:
  [rootSERVER neko]# /etc/init.d/httpd start
  Starting httpd: /bin/bash: line 1:  2475 Segmentation
fault      /usr/sbin/httpd
                                                          
[FAILED]
  
  Here is the system data:
    uname -a:
      Linux 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST
2008 i686 i686 i386 GNU/Linux
    httpd -v:
      Server version: Apache/2.2.8 (Unix)
      Server built:   Jan 28 2008 06:24:44
    gcc -v:
      Target: i386-redhat-linux
      Configured with: ../configure --prefix=/usr
      --mandir=/usr/share/man --infodir=/usr/share/info
      --enable-shared --enable-threads=posix
--enable-checking=release
      --with-system-zlib --enable-__cxa_atexit
      --disable-libunwind-exceptions
     
--enable-languages=c,c++,objc,obj-c++,java,fortran,ada
      --enable-java-awt=gtk --disable-dssi --enable-plugin
     
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-1.5.0.0/jre
      --enable-libgcj-multifile
--enable-java-maintainer-mode
      --with-ecj-jar=/usr/share/java/eclipse-ecj.jar
      --with-cpu=generic --host=i386-redhat-linux          
      Thread model: posix
      gcc version 4.1.2 20070925 (Red Hat 4.1.2-33)

  I can do some gdb checks... if someone points me how to do
that,
  never tried gdb before.
  

-- 
Best regards,
 Michael                          mailto:mikecomapping.com


-- 
Neko : One VM to run them all
(http://nekovm.org)

Michael Pliskin a écrit :
> Hello all,
> 
>   I was just trying to set up neko in a Fedora Core 8
and got
>   Segmentation Fault error when starting Apache with
mod_neko2 loaded.
>   I've tried both 1.6.0 and 1.6.1 from CVS - same
problem. Without
>   mod_neko, Apache runs fine..
[...]
>   I can do some gdb checks... if someone points me how
to do that,
>   never tried gdb before.

Yes, that would be help. Google for gdb+tutorial to find
detailed 
explanations about gdb usage. In order to compile
neko+mod_neko in debug 
mode you need to add -g in Makefile (CFLAGS) and
neko/tools/install.neko

Best,
Nicolas

-- 
Neko : One VM to run them all
(http://nekovm.org)

Hello Nicolas,

NC> Yes, that would be help. Google for gdb+tutorial to
find detailed
NC> explanations about gdb usage. In order to compile
neko+mod_neko in debug
NC> mode you need to add -g in Makefile (CFLAGS) and
neko/tools/install.neko

Hmm run into a pretty weird problem:
[rootSERVER ~]# /etc/init.d/httpd start
Starting httpd: /bin/bash: line 1:  2009 Segmentation fault 
    /usr/sbin/httpd
                                                          
[FAILED]

BUT
[rootSERVER ~]# bash /etc/init.d/httpd start
Starting httpd:                                            [
 OK  ]

and moreover
/usr/sbin/httpd -k start
is ok as well..

Any ideas where to look? Zero understanding how do I catch
this
segfault using gdb as it happens in a process spawned from a
process
spawned from a bash script :( I tried
  gdb bash
and then
  run -c "/etc/init.d/httpd start"
but failed because of several levels of fork.. Tried 'set
follow-fork-mode child' but didn't help either - it just
waits for
input after dumping the error message, so I guess it doesn't
follow
fork all the time or whatever.

The amazing thing is that Fedora Core 7 behaves absolutely
identically
(running both as vmware machines). And I have a production
server
running on FC6, with the same apache 2.2.4 as on FC7...
Really weird.

-- 
Best regards,
 Michael                            mailto:mikecomapping.com


-- 
Neko : One VM to run them all
(http://nekovm.org)

Hello all,

NC> Yes, that would be help. Google for gdb+tutorial to
find detailed
NC> explanations about gdb usage. In order to compile
neko+mod_neko in debug
NC> mode you need to add -g in Makefile (CFLAGS) and
neko/tools/install.neko

  ok, the trouble got solved now. It was, however, far from
trivial...

  The root cause is selinux being enabled. It disallows
something done
  by neko (looks like executing memory), and makes apache
crash
  mysteriously.

  So the way to get this resolved is to apply the following
selinux
  policy (named nekohttpd for instance):

module nekohttpd 1.0;

require {
        type httpd_t;
        class process execmem;
}

#============= httpd_t ==============
allow httpd_t self:process execmem;

  if this particular one doesn't work for your system, here
is the
  more generic approach:

  1. install audit:
     yum install audit
  2. start audit daemon:
     /etc/init.d/auditd start
  3. try starting apache:
     /etc/init.d/httpd start
  4. make the policy to permit everything apache is failing
to do:
     grep http /var/log/audit/audit.log | audit2allow -M
nekohttpd


  now you have the compiled nekohttpd.pp policy - only
install it:
  semodule -i nekohttpd.pp

  Nothing fancy after all  But this
probably should go to FAQ or
  installation guide, otherwise it is really difficult to
solve (if
  you have never even heard of selinux especially).

-- 
Best regards,
 Michael                            mailto:mikecomapping.com


-- 
Neko : One VM to run them all
(http://nekovm.org)

Michael,

I had the exact same problem using CentOS. I saw from gdb
that  
selinux was causing the problems.
I couldn't solve it, and had to install RHEL4 instead. There
was some  
communication about this
on the list.

Nice that you discovered how to deal with it, and yes it
would be  
great if you could add it to
the FAQ or install instructions on haxe.org.

Good stuff,

/ mquickform


On Mar 19, 2008, at 5:23 PM, Michael Pliskin wrote:

> Hello all,
>
> NC> Yes, that would be help. Google for gdb+tutorial
to find detailed
> NC> explanations about gdb usage. In order to
compile neko+mod_neko  
> in debug
> NC> mode you need to add -g in Makefile (CFLAGS) and
neko/tools/ 
> install.neko
>
>   ok, the trouble got solved now. It was, however, far
from trivial...
>
>   The root cause is selinux being enabled. It disallows
something done
>   by neko (looks like executing memory), and makes
apache crash
>   mysteriously.
>
>   So the way to get this resolved is to apply the
following selinux
>   policy (named nekohttpd for instance):
>
> module nekohttpd 1.0;
>
> require {
>         type httpd_t;
>         class process execmem;
> }
>
> #============= httpd_t ==============
> allow httpd_t self:process execmem;
>
>   if this particular one doesn't work for your system,
here is the
>   more generic approach:
>
>   1. install audit:
>      yum install audit
>   2. start audit daemon:
>      /etc/init.d/auditd start
>   3. try starting apache:
>      /etc/init.d/httpd start
>   4. make the policy to permit everything apache is
failing to do:
>      grep http /var/log/audit/audit.log | audit2allow
-M nekohttpd
>
>
>   now you have the compiled nekohttpd.pp policy - only
install it:
>   semodule -i nekohttpd.pp
>
>   Nothing fancy after all  But this
probably should go to FAQ or
>   installation guide, otherwise it is really difficult
to solve (if
>   you have never even heard of selinux especially).
>
> -- 
> Best regards,
>  Michael                            mailto:mikecomapping.com
>
>
> -- 
> Neko : One VM to run them all
> (http://nekovm.org)


-- 
Neko : One VM to run them all
(http://nekovm.org)

Hello Marcus,

  I am sorry I've probably missed your thread, and I've
actually
  failed to understand with gdb that selinux is the one to
blame. To
  make things worse, I was running Fedora as a vmware
virtual machine,
  and was always accessing the machine via SSH, not 'local'
console.
  SELinux, however, only dumps its messages to local console
by
  default, and I had nearly zero chance finding seeing them
 Only
by
  accident I tried the brand new VMWare Web Console to see
how it
  works, and wow! I get the messages, and then it was not
so
  difficult.

  I was also changing distros (tried FC8, FC7 and CentOS
5.1) and
  Virtual Machines with no luck for nearly 2 weeks 

  I will put that somewhere once Nicolas gives his
comments..

Mike

MB> I had the exact same problem using CentOS. I saw from
gdb that  
MB> selinux was causing the problems.
MB> I couldn't solve it, and had to install RHEL4
instead. There was some
MB> communication about this
MB> on the list.

MB> Nice that you discovered how to deal with it, and yes
it would be  
MB> great if you could add it to
MB> the FAQ or install instructions on haxe.org.

MB> Good stuff,

MB> / mquickform


MB> On Mar 19, 2008, at 5:23 PM, Michael Pliskin wrote:

>> Hello all,
>>
>> NC> Yes, that would be help. Google for
gdb+tutorial to find detailed
>> NC> explanations about gdb usage. In order to
compile neko+mod_neko  
>> in debug
>> NC> mode you need to add -g in Makefile (CFLAGS)
and neko/tools/ 
>> install.neko
>>
>>   ok, the trouble got solved now. It was, however,
far from trivial...
>>
>>   The root cause is selinux being enabled. It
disallows something done
>>   by neko (looks like executing memory), and makes
apache crash
>>   mysteriously.
>>
>>   So the way to get this resolved is to apply the
following selinux
>>   policy (named nekohttpd for instance):
>>
>> module nekohttpd 1.0;
>>
>> require {
>>         type httpd_t;
>>         class process execmem;
>> }
>>
>> #============= httpd_t ==============
>> allow httpd_t self:process execmem;
>>
>>   if this particular one doesn't work for your
system, here is the
>>   more generic approach:
>>
>>   1. install audit:
>>      yum install audit
>>   2. start audit daemon:
>>      /etc/init.d/auditd start
>>   3. try starting apache:
>>      /etc/init.d/httpd start
>>   4. make the policy to permit everything apache is
failing to do:
>>      grep http /var/log/audit/audit.log |
audit2allow -M nekohttpd
>>
>>
>>   now you have the compiled nekohttpd.pp policy -
only install it:
>>   semodule -i nekohttpd.pp
>>
>>   Nothing fancy after all  But this
probably should go to FAQ or
>>   installation guide, otherwise it is really
difficult to solve (if
>>   you have never even heard of selinux
especially).
>>
>> -- 
>> Best regards,
>>  Michael                            mailto:mikecomapping.com
>>
>>
>> -- 
>> Neko : One VM to run them all
>> (http://nekovm.org)



-- 
Best regards,
 Michael                            mailto:mikecomapping.com


-- 
Neko : One VM to run them all
(http://nekovm.org)