3

I have asked this question on StackOverflow but given the comment there it seems like it fits here better.

This is almost certainly a system configuration issue—you didn't set up the jail right—rather than a Python one. You can test that very easily by just seeing what happens when you run, say, head -c16 /dev/urandom or dd if=/dev/urandom bs=16 count=1 from inside the jail. If you get the same error, go ask on SuperUser or ServerFault or another general Unix or OpenBSD forum. – abarnert

Here's what I've done:

I want to run some cgi scripts (written in Python) on my OpenBSD server. Since the web-server on OpenBSD runs in a jail I recreated the whole folder structure (/bin /dev /usr /usr/local/lib etc. etc.) but I'm still getting '500 Server Internal Error' when I'm trying to import some Python modules that require access to /dev/urandom device.

I have created the device special files using mknod.

ls -la /dev/*random
ls -la /dev/{null,zero}

I got the following output

crw-r--r--  1 root  wheel   45,   3 Sep 13 11:09 /dev/arandom
crw-r--r--  1 root  wheel   45,   0 Jul 15 19:02 /dev/random
crw-r--r--  1 root  wheel   45,   1 Jul 15 19:02 /dev/srandom
crw-r--r--  1 root  wheel   45,   2 Jul 15 19:02 /dev/urandom

and

crw-rw-rw-  1 root  wheel    2,   2 Sep 16 01:30 /dev/null
crw-rw-rw-  1 root  wheel    2,  12 Jul 15 19:02 /dev/zero

So I executed the following commands in the /var/www/dev folder (OpenBSD web-server runs in chroot -u www /var/www)

mknod -m 666 null c 2 2
mknod -m 666 zero c 2 12
mknod -m 644 random 45 0
mknod -m 644 srandom 45 1
mknod -m 644 urandom 45 2
mknod -m 644 arandom 45 3

However, Python still reports that the 

OSError: [Errno 6] Device not configured '/dev/urandom'

The same code works fine in a non-chroot-ed environment.

import os
import cgitb
cgitb.enable()

Given the advice on StackOverflow I run

chroot -u www /var/www dd if=/dev/urandom bs=16 count=1

and got the same result

dd: /dev/urandom: Device not configured

i.e. it's definitely a config error. Can anyone shed some light where I may be making a mistake? Any help would be truly appreciated!

Community
  • 1
TDrabas
  • 186

3 Answers3

3

I found the culprit.

Following the advice from the comments section of this site it is enough to mknod (as I have done earlier) and remove nodev from /etc/fstab where the system mounts /var. This removes the 'no-devices' allowed flag in /var.

To make my script run I finally had to copy all the shared objects that Python's cgitb module (well, in fact, _hashlib.so) depends on -- namely libcrypto.so.

To find what your _hashlib.so depends on run ldd _hashlib.so -- mine is located in /usr/local/lib/python2.7/lib-dynload/_hashlib.so. Note -- you will find this library if you have OpenSSL installed on your system. If you don't, _hashlib.so loads e.g. _md5.so etc. that can only be find if you

  1. Don't have OpenSSL
  2. Configured and built Python with --with-pydebug flag (check this answer for more details)

Hope this helps!

Community
  • 1
TDrabas
  • 186
0

check /etc/fstab. I had nodev in the mount point and that prevented my chroot'd command from running properly.

Richard
  • 101
  • 3
-1

I Had similar problem running Django in FreeBSD and OPENBSD. My problem was that the gunicorn process was running as root while the scripts were in outher users home/dir.

tl;dr -> check if the process is running with the right user

Carlos Henrique Cano
  • 99