Lighttpd

Setting perms that deny lighty access causes 500 error. (eg. 600 perms with root:root owner)

Steps to reproduce:

• dir-listing.activate = "enable"
• restrict the user which lighty is running as to the dir

Note..¶

I also have the new mod_postgresql_vhost in my .conf and haven't confirmed if removing that fixes the issue.. as you can see in the strace it looks like a select statement is executing.

lighttpd.conf¶

$HTTP[[host]] == "www.foo.com" {
        server.document-root = "/sites/www.foo.com/www/" 
        dir-listing.activate = "enable" 
}

Strace¶

epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635598
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635599
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635600
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {{EPOLLIN, {u32=4, u64=4}}}, 4096, 1000) = 1
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
accept(4, {sa_family=AF_INET, sin_port=htons(58897), sin_addr=inet_addr("xxx.xxx.xxx.xxx")}, r16) = 11
fcntl64(11, F_SETFD, FD_CLOEXEC)        = 0
fcntl64(11, F_SETFL, O_RDWR|O_NONBLOCK) = 0
accept(4, 0x5dd866c0, r112)            = -1 EAGAIN (Resource temporarily unavailable)
read(11, 0x17c4f968, 16384)             = -1 EAGAIN (Resource temporarily unavailable)
epoll_ctl(8, EPOLL_CTL_ADD, 11, {EPOLLIN|EPOLLERR|EPOLLHUP, {u32=11, u64=11}}) = 0
time(NULL)                              = 1176635600
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {{EPOLLIN, {u32=11, u64=11}}}, 4096, 1000) = 1
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
epoll_ctl(8, EPOLL_CTL_DEL, 11, {0, {u32=0, u64=0}}) = 0
read(11, "GET /pkgdir/soekris-4801/ HTTP/1"..., 16384) = 519
rt_sigprocmask(SIG_BLOCK, [[PIPE]], [[RTMIN]], 8) = 0
send(12, "Q\0\0\0DSELECT docroot FROM domains"..., 69, 0) = 69
rt_sigprocmask(SIG_SETMASK, [[RTMIN]], NULL, 8) = 0
poll([[{fd=12|events=POLLINPOLLERR, revents=POLLIN}]], 1, -1) = 1
recv(12, "T\0\0\0 \0\1docroot\0\0\0T\27\0\2\0\0\4\23\377\377\0\0"..., 16384, 0) = 51
open("/sites/www.foo.com/www/pkgdir/soekris-4801", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_NOATIME) = -1 EPERM (Operation not permitted)
write(7, "response.c.571: (error) checking"..., 175) = 175
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2819, ...}) = 0
setsockopt(11, SOL_TCP, TCP_CORK, r1, 4) = 0
writev(11, [{"HTTP/1.1 500 Internal Server Err"..., 145}, {"<?xml version=\"1.0\" encoding=\"is"..., 369}], 2) = 514
setsockopt(11, SOL_TCP, TCP_CORK, r0, 4) = 0
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2819, ...}) = 0
write(3, "88.232.61.200 update.netsyncro.c"..., 187) = 187
read(11, 0x17c4f968, 16384)             = -1 EAGAIN (Resource temporarily unavailable)
epoll_ctl(8, EPOLL_CTL_ADD, 11, {EPOLLIN|EPOLLERR|EPOLLHUP, {u32=11, u64=11}}) = 0
time(NULL)                              = 1176635600
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {{EPOLLIN, {u32=11, u64=11}}}, 4096, 1000) = 1
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
epoll_ctl(8, EPOLL_CTL_DEL, 11, {0, {u32=0, u64=0}}) = 0
read(11, "GET /favicon.ico HTTP/1.1\r\nUser-"..., 16384) = 523
rt_sigprocmask(SIG_BLOCK, [[PIPE]], [[RTMIN]], 8) = 0
send(12, "Q\0\0\0DSELECT docroot FROM domains"..., 69, 0) = 69
rt_sigprocmask(SIG_SETMASK, [[RTMIN]], NULL, 8) = 0
poll([[{fd=12|events=POLLINPOLLERR, revents=POLLIN}]], 1, -1) = 1
recv(12, "T\0\0\0 \0\1docroot\0\0\0T\27\0\2\0\0\4\23\377\377\0\0"..., 16384, 0) = 51
open("/sites/www.foo.com/www/favicon.ico", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_NOATIME) = -1 ENOENT (No such file or directory)
setsockopt(11, SOL_TCP, TCP_CORK, r1, 4) = 0
writev(11, [{"HTTP/1.1 404 Not Found\r\nContent-"..., 133}, {"<?xml version=\"1.0\" encoding=\"is"..., 345}], 2) = 478
setsockopt(11, SOL_TCP, TCP_CORK, r0, 4) = 0
write(3, "88.232.61.200 update.netsyncro.c"..., 191) = 191
read(11, 0x17c4f968, 16384)             = -1 EAGAIN (Resource temporarily unavailable)
epoll_ctl(8, EPOLL_CTL_ADD, 11, {EPOLLIN|EPOLLERR|EPOLLHUP, {u32=11, u64=11}}) = 0
time(NULL)                              = 1176635601
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635602
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635603
kill(90, SIGRTMIN)                      = 0
epoll_wait(8, {}, 4096, 1000)           = 0
kill(90, SIGRTMIN)                      = 0
kill(90, SIGRTMIN)                      = 0
time(NULL)                              = 1176635604
kill(90, SIGRTMIN)                      = 0
epoll_wait(8,  <unfinished ...>
Process 5538 detached