在 CGI 程序中访问 Hypertable 时权限被拒绝
我正在尝试使用 Hypertable 在 Perl 中开发一个 Web 应用程序。示例代码：
#!/usr/bin/perl -w
use strict;
use warnings;
use CGI;
use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
use CGI::Session ('-ip_match');
use Hypertable::ThriftClient;
use Data::Dumper;
my $q = new CGI;
print $q->header(-cache_control => "no-cache, no-store, must-revalidate");
eval {
my $client = new Hypertable::ThriftClient("localhost", 38080);
my $namespace = $client->open_namespace("glinpe");
my $result = $client->hql_exec($namespace, "select * from words where row=\"maths\" keys_only");
};
if ($@) {
if ($@->isa('Thrift::TException')) {
print Dumper($@);
} else {
print Dumper($@);
}
}
print "<h1>works</h1>";
问题是当尝试从 Web 浏览器执行时出现错误：
$VAR1 = bless( { 'code' => 0, 'message' => 'TSocket: Could not connect to localhost:38080 (Permission denied)' }, 'Thrift::TException' );
从终端（在 apache 用户下）运行时脚本可以正常工作，如果删除所有 Hypertable 代码，在浏览器中也可以正常工作。
我在 iptables 中打开了 38080 端口：
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 38080 -j ACCEPT
操作系统：Centos 5.6。
I'm trying to develop a Web app in Perl using Hypertable. Sample code:
#!/usr/bin/perl -w
use strict;
use warnings;
use CGI;
use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
use CGI::Session ('-ip_match');
use Hypertable::ThriftClient;
use Data::Dumper;
my $q = new CGI;
print $q->header(-cache_control => "no-cache, no-store, must-revalidate");
eval {
my $client = new Hypertable::ThriftClient("localhost", 38080);
my $namespace = $client->open_namespace("glinpe");
my $result = $client->hql_exec($namespace, "select * from words where row=\"maths\" keys_only");
};
if ($@) {
if ($@->isa('Thrift::TException')) {
print Dumper($@);
} else {
print Dumper($@);
}
}
print "<h1>works</h1>";
The problem is when trying to execute from a web browser I get an error:
$VAR1 = bless( { 'code' => 0, 'message' => 'TSocket: Could not connect to localhost:38080 (Permission denied)' }, 'Thrift::TException' );
The scripts works properly when running from a terminal(under apache user), and as well in a browser if remove all Hypertable code.
I have 38080 port opened in iptables:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 38080 -j ACCEPT
OS: Centos 5.6.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
错误消息表明您缺少权限，因此这就是答案（用户 apache，无权创建到 localhost:38080 的套接字）
更新：详细说明，当您从终端运行它时，它运行为普通用户，但是当 apache 运行它时，大多数情况下它在 apache 用户帐户下运行，该帐户可能没有打开套接字的权限。
可能您正在使用 SELinux，在这种情况下请参阅“man chcon”
或搜索“SELinux 教程：配置 RHEL 5 和 Web 服务器”
The error message says you're missing permission, so that would be the answer (user apache, doesn't have permission to create socket to localhost:38080)
update: to elaborate, when you run it from a terminal, it is running as a regular user, but when apache runs it, most often it is running under apache user account, which may not have permission to open sockets
It could be you're using SELinux in which case see 'man chcon'
or search for "SELinux tutorial: Configuring RHEL 5 and Web servers"
好的，这个特定问题有两种解决方案：
1.禁用selinux - 更改/etc/selinux/config中的配置
2.运行命令：
setsebool -P httpd_can_network_connect 1
感谢之前的回答让我回到正轨。
OK, so there is two solution to this particular problem:
1. disable selinux - change configuration in /etc/selinux/config
2. run command:
setsebool -P httpd_can_network_connect 1
Thanks to previous answer for putting me back on track.