Permission denied(13) error after execute "sudo yum update"

[Liz Huang]

Hi, 

My web apps in Red Hat Enterprise Linux 7 by Ruby On Rails + Passenger are working 

until this morning after I did "sudo yum update". The error I got is:

An error occurred while starting up the preloader. It exited before signalling successful startup back to Phusion Passenger. 

Please read this article for more information about this problem.

Raw process output:

/bin/bash: /home/lxh37/.bash_profile: Permission denied

*** ERROR ***: Cannot execute /home/lxh37/.rbenv/versions/2.2.3/bin/ruby: Permission denied (13)

I read the linked article, don't find anything useful. Wonder if this is new bug? New happened

before as I have to do "sudo yum update" every month.

Thanks!

Liz

[Liz Huang]

I mean that I have to do "sudo yum update" every month, but didn't have this issue before. 

If further information needed for investigation, please let me know. Thanks! 

Now I have to take down all three web apps. 

Liz

[Camden Narzt]

RHEL 7.3 updated their SELinux userspace and it represents a breaking change (as you've found) we've updated our SELinux policy in our rpm for passenger 5.1.0, so waiting for that is one approach. Another is to make your webapp selinux compliant by relabeling the files under selinux.

To summarize the contexts that I've found to be good fits:

start by setting everything in your app dir to httpd_sys_content_t
then set the log & tmp dirs & their contents to httpd_sys_rw_content_t
and then set the *.so files to httpd_unconfined_script_exec_t

If you are pursuing this approach, you will also have to relabel the rbenv files in your home directory, which are a bit more sensitive. You'll have to look at the labels available and choose ones that allow your webserver access but don't jeopardize your security.

[Liz Huang]

Thanks for your quick reply. May I know the release date for passenger 5.1.0?

I feel uncomfortable to relabel the rbenv files in your home directory if it might

jeopardize the security if I don't do everything right. 

Thanks!

Liz

[Camden Narzt]

We're planning on releasing 5.1.0 in the next few days.

[Liz Huang]

Thanks! Is there a list that I can be added to get notification when it is released?

Is there anything else I need to do to fix the problem other than install the new

release 5.1.0?

Best

Liz

[Camden Narzt]

We announce releases on our blog, which has an rss feed: https://blog.phusion.nl/rss/

[Liz Huang]

I try to subscribe to the feed, but it is currently broken...

Liz

[Hongli Lai]

What exactly do you mean by broken? If I visit the feed then I get a proper feed XML.

--
You received this message because you are subscribed to the Google Groups "Phusion Passenger Discussions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phusion-passenger+unsubscribe@googlegroups.com.
To post to this group, send email to phusion-passenger@googlegroups.com.
Visit this group at https://groups.google.com/group/phusion-passenger.

To view this discussion on the web visit https://groups.google.com/d/msgid/phusion-passenger/9a4f7890-37fe-4560-a07b-90fed7180d3a%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Phusion B.V. | Web Application deployment, scaling, and monitoring solutions

Web: http://www.phusion.nl/
E-mail: in...@phusion.nl
Chamber of commerce no: 63501007 (The Netherlands)

[Liz Huang]

I got a page with 

This XML file does not appear to have any style information associated with it. The document tree is shown below.

and XML code...

To unsubscribe from this group and stop receiving emails from it, send an email to phusion-passen...@googlegroups.com.
To post to this group, send email to phusion-...@googlegroups.com.

Visit this group at https://groups.google.com/group/phusion-passenger.

To view this discussion on the web visit https://groups.google.com/d/msgid/phusion-passenger/9a4f7890-37fe-4560-a07b-90fed7180d3a%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Daniel Knoppel]

Try Firefox or install an RSS reader plugin in your browser. 

- Daniel

[Liz Huang]

Thanks! Work in firefox.

Liz