IPC permissions problem with Apache 2, suexec, FastCGI, Ruby On Rails on Solaris 10

Apologies if this has been covered before ...

I'm running a Rails app on Apache 2.0.54 on a Solaris 10 x86-AMD64  
system with FastCGI 2.4.2.  I been able to get it all set up and  
working without suexec, but I was having problems with db access  
because the Rails dispatch.fcgi process was running as nobody.  So I  
set up suexec and got my Rails processes running as the right user,  
but now the IPC doesn't seem to be working -- page fetches just hang  
and mod_fastcgi seems to be trying to start dynamic processes (as  
root!) when the proper Rails processes are still out there.

I believe I have suexec etc. configured properly -- the file/ 
directory ownerships for the .fcgi scripts are right etc.

Here's what I think is going wrong:

     * Apache runs as nobody
     * FastCGI starts the designated child processes with the "store"  
uid
     * The FastCGI IPC directory has permissions like this:
     drwxrwxrwt   3 nobody   nobody       359 Sep 15 15:11 .
     srw-------   1 nobody   nobody         0 Sep 15 15:11  
341af01f91d14f3af5e6733858ef5e48
     * The Rails processes are NOT able to access the IPC since:
         - Rails is running as "store"
         - The IPC socket is restricted to 'nobody'

Does this make sense?

I like the way this is setup, with Apache running as nobody and the  
Rails app running as store (if it would work!), so I'd rather not  
have it all run as "store" or try to make the Rails app run as nobody  
(since I next need to add another application that runs as a  
different user).

Thanks for any help!


Dave.
---

Here are the relevant parts of my configuration/logs.  As you can see  
from the tail of errors_log, fastcgi starts a new dynamic server, but  
ps shows that the original process is still there.  The dynamic  
server terminates with 107 because suexec won't run it as root  
(forbidden uid).

--- httpd.conf ---

LogLevel info

User nobody
Group nobody

...

<IfModule mod_fastcgi.c>
   FastCgiIpcDir /tmp/fcgi_ipc
   FastCgiWrapper /usr/apache2/bin/suexec
   FastCgiServer /export/home/store/Work/Rails/store/public/ 
dispatch.fcgi \
       -initial-env RAILS_ENV=development \
       -processes 5 -idle-timeout 60 \
       -user store -group nobody
</IfModule>


--- ps -ef | grep fcgi ---
    store 29439 29427   0 15:11:33 ?           0:01 /usr/bin/ruby  
dispatch.fcgi
    store 29437 29427   0 15:11:31 ?           0:01 /usr/bin/ruby  
dispatch.fcgi
    store 29438 29427   0 15:11:32 ?           0:01 /usr/bin/ruby  
dispatch.fcgi
    store 29436 29427   0 15:11:30 ?           0:01 /usr/bin/ruby  
dispatch.fcgi
    store 29430 29427   0 15:11:29 ?           0:01 /usr/bin/ruby  
dispatch.fcgi


--- errors_log ---
[Thu Sep 15 15:11:28 2005] [info] Server: Apache/2.0.54, Interface:  
mod_ssl/2.0.
54, Library: OpenSSL/0.9.8
[Thu Sep 15 15:11:28 2005] [notice] suEXEC mechanism enabled  
(wrapper: /usr/apac
he2/bin/suexec)
[Thu Sep 15 15:11:28 2005] [notice] FastCGI: wrapper mechanism  
enabled (wrapper:
/usr/apache2/bin/suexec)
[Thu Sep 15 15:11:28 2005] [notice] FastCGI: process manager  
initialized (pid 29
427)
[Thu Sep 15 15:11:29 2005] [warn] FastCGI: server "/export/home/store/ 
Work/Rails
/store/public/dispatch.fcgi" (uid 103, gid 60001) started (pid 29430)
[Thu Sep 15 15:11:29 2005] [notice] Apache/2.0.54 (Unix) mod_ssl/ 
2.0.54 OpenSSL/
0.9.8 mod_fastcgi/2.4.2 configured -- resuming normal operations
[Thu Sep 15 15:11:29 2005] [info] Server built: Sep 15 2005 04:34:03
[Thu Sep 15 15:11:30 2005] [warn] FastCGI: server "/export/home/store/ 
Work/Rails
/store/public/dispatch.fcgi" (uid 103, gid 60001) started (pid 29436)
[Thu Sep 15 15:11:31 2005] [warn] FastCGI: server "/export/home/store/ 
Work/Rails
/store/public/dispatch.fcgi" (uid 103, gid 60001) started (pid 29437)
[Thu Sep 15 15:11:32 2005] [warn] FastCGI: server "/export/home/store/ 
Work/Rails
/store/public/dispatch.fcgi" (uid 103, gid 60001) started (pid 29438)
[Thu Sep 15 15:11:33 2005] [warn] FastCGI: server "/export/home/store/ 
Work/Rails
/store/public/dispatch.fcgi" (uid 103, gid 60001) started (pid 29439)
[Thu Sep 15 15:23:17 2005] [warn] FastCGI: (dynamic) server "/export/ 
home/store/
Work/Rails/store/public/dispatch.fcgi" (uid 0, gid 0) started (pid  
29451)
[Thu Sep 15 15:23:17 2005] [warn] FastCGI: (dynamic) server "/export/ 
home/store/
Work/Rails/store/public/dispatch.fcgi" (pid 29451) terminated by  
calling exit wi
th status '107'
[Thu Sep 15 15:23:32 2005] [warn] FastCGI: (dynamic) server "/export/ 
home/store/
Work/Rails/store/public/dispatch.fcgi" has failed to remain running  
for 30 secon
ds given 3 attempts, its restart interval has been backed off to 600  
seconds


--- suexec_log ---
[2005-09-15 15:11:29]: uid: (store/store) gid: (nobody/nobody) cmd:  
dispatch.fcgi
[2005-09-15 15:11:30]: uid: (store/store) gid: (nobody/nobody) cmd:  
dispatch.fcgi
[2005-09-15 15:11:31]: uid: (store/store) gid: (nobody/nobody) cmd:  
dispatch.fcgi
[2005-09-15 15:11:32]: uid: (store/store) gid: (nobody/nobody) cmd:  
dispatch.fcgi
[2005-09-15 15:11:33]: uid: (store/store) gid: (nobody/nobody) cmd:  
dispatch.fcgi
[2005-09-15 15:23:17]: uid: (root/root) gid: (0/0) cmd: dispatch.fcgi
[2005-09-15 15:23:17]: cannot run as forbidden uid (0/dispatch.fcgi)

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/