Why does mod_fastcgi in Apache complain that it does not have permission to create server?

Question

This is a very old FastCGI issue but I have never found a satisfactory answer.

Searching the phrase "(13) permission denied fastcgi can't create server" on Google will show that there's a lot of people experiencing this issue for a long while.

Some people blame it on selinux and suggest turning it off (not acceptable solution).

Other people think that it's a strange symlink permissions problem and suggest turning the Apache logs directory from symlink to a plain directory. (not acceptable, since it involves moving the logs files) See Installing FastCGI.

Below is the dreaded error as typically logged by Apache.

[Wed Jun 14 22:09:34 2009] [notice] Apache/2.0.40> (Red Hat Linux) configured 
-- resuming normal operations
[Wed Jun 14 22:09:35 2009] [crit] (13)Permission
denied: FastCGI: can't create server "/var/rt3/bin/mason_handler.fcgi": bind()
failed [/etc/httpd/logs/fastcgi/70d9a528c5892f2bf0c25e5a334bed81]

Hoping serverfault can finally provide a definitive answer to this perplexing and annoying problem which has plague FastCGI users for years.

I feel uneasy implementing the suggested "cures" when no one really knows the underlying cause of this illness. Hope to get to the bottom of this mystery.

Answer 1

I've fixed this problem by

chown apache:apache /etc/httpd/logs/

Answer 2

From /usr/lib/errno.h

#define EACCES          13      /* Permission denied */

mod_fcgi communicates with fastCGI children via a named pipe. Apache creates the pipe before spawning the children. I would guess that apache does not have permission to create

/var/rt3/bin/mason_handler.fcgi

To check this try

su - apache "touch /var/rt3/bin/mason_handler.fcgi"

If that failes, adjust the filesystem permissions appropriately to give apache permission to create a file in that directory.

Answer 3

For working under SELinux, try using mod_fcgid instead of mod_fastcgi. I tried mod_fastcgi with SELinux on CentOS 5.6 for three hours and googled around and got nowhere. It's an issue with mod_fastcgi trying to create the pipe/socket to communicate with the fastcgi apps. I tried every permission/SELinux context I could think of on the /var/log/httpd/fastcgi folder (where mod_fastcgi creates the named pipe), but nothing worked. Then I switched to mod_fcgid (downloaded EL5 rpm from rpm.pbone.net), which apparently doesn't use the same communication method to talk to the fastcgi apps, and everything worked perfectly, just as if the fastcgi app was a regular cgi app! You still have to set the correct SELinux contexts on your files (see man page for httpd_selinux). E.g. you want to do chcon -t httpd_sys_script_exec_t fcgiapp and also chcon -t httpd_sys_script_r[w|o|a]_t on any file your script accesses/modifies, and you may have to set some of the allow_httpd... booleans with the setsebool command. And of course you have to set the regular file permissions correctly as well. There are web tutorials that go through typical mod_fcgi configuration.

Answer 4

The user that the fastcgi process is running as doesn't have permissions to bind to whatever socket you're asking it to bind to. There could be any number of reasons for it, there isn't enough information to make a useful diagnosis.