Home / server / Questions / 408021
Accepted
Hugh Guiney
Asked: 2012-07-16 21:16:04 +0800 CST

SuExec: “command not in docroot” Even Though It Is?

  • 772
  • Arch Linux 2011.08.19 (Linux 3.4.2 i686)
  • Apache 2.2.22 with SuExec
  • PHP 5.4.4 (cli) via FastCGI

My sites were all working fine earlier… I’m not sure when it happened because I noticed it over a week later (I’m guessing perhaps after a system upgrade), but all my VirtualHosts went offline with the dreaded “Premature end of script headers: php-fcgid-wrapper” 500 error.

SuExec logs gave me this for each site:

[2012-07-16 00:45:02]: uid: (1001/site) gid: (1001/site) cmd: php-fcgid-wrapper
[2012-07-16 00:45:02]: command not in docroot (/var/www/site/fcgi-bin/php-fcgid-wrapper)

This isn’t (or at least shouldn’t be) true… I automatically compile Apache with --with-suexec-docroot=/srv/www set. Still, I tried a sanity check, to see what docroot SuExec actually thought it had:

$ suexec -V
suexec policy violation: see suexec log for more details

For which the logs claimed:

[2012-07-16 01:07:52]: too few arguments

Tried it with sudo as well; same thing. So, even this makes no sense, and prevents me from being able to diagnose the problem properly.

Another thing I tried was moving everything from /srv/www to /var/www, the default docroot, to see if maybe it had reverted to the raw repository version during the upgrade. Updated my VirtealHosts, restarted Apache, but still got the same 500 errors.

What else could be causing this?

php apache-2.2 fastcgi arch-linux suexec

4 Answers

  1. You don't need to recompile it. You can use this package to set a custom path on debian or ubuntu:

    apt-get install apache2-suexec-custom

    After installing the package, there is a special directory, where you can set the suexec path for every user. There should be an example file für www-data user:

    /etc/apache/suexec/<some-user-name>

    If you don't have Debian or Ubuntu, you have to look for such a package or recompile suexec with the right docroot (see suexec doc). The param is:

    --with-suexec-docroot=DIR

    You have to check, how to do it for your distro.

    • 2

  2. Find the fcgid configurations with this command:

    /usr/lib/apache2/suexec -V

-D AP_DOC_ROOT="/var/www"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="www-data"
-D AP_LOG_EXEC="/var/log/apache2/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX="public_html"

    The wrapper must be written in the directory tree of: AP_DOC_ROOT to be accessed and run.

    • 1

  3. There's a www-data file (/etc/apache2/suexec/www-data) with 2 lines:

    /var/www
/public/cgi-bin/

    you can change that lines to what you prefer

    • 1
  4. Best Answer

    You need to recompile suexec.c --with-suexec-docroot=/srv/www

    • 0