Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have asked this question on StackOverflow but given the comment there it seems like it fits here better.

This is almost certainly a system configuration issue—you didn't set up the jail right—rather than a Python one. You can test that very easily by just seeing what happens when you run, say, head -c16 /dev/urandom or dd if=/dev/urandom bs=16 count=1 from inside the jail. If you get the same error, go ask on SuperUser or ServerFault or another general Unix or OpenBSD forum. – abarnert

Here's what I've done:

I want to run some cgi scripts (written in Python) on my OpenBSD server. Since the web-server on OpenBSD runs in a jail I recreated the whole folder structure (/bin /dev /usr /usr/local/lib etc. etc.) but I'm still getting '500 Server Internal Error' when I'm trying to import some Python modules that require access to /dev/urandom device.

I have created the device special files using mknod.

ls -la /dev/*random
ls -la /dev/{null,zero}

I got the following output

crw-r--r--  1 root  wheel   45,   3 Sep 13 11:09 /dev/arandom
crw-r--r--  1 root  wheel   45,   0 Jul 15 19:02 /dev/random
crw-r--r--  1 root  wheel   45,   1 Jul 15 19:02 /dev/srandom
crw-r--r--  1 root  wheel   45,   2 Jul 15 19:02 /dev/urandom

and

crw-rw-rw-  1 root  wheel    2,   2 Sep 16 01:30 /dev/null
crw-rw-rw-  1 root  wheel    2,  12 Jul 15 19:02 /dev/zero

So I executed the following commands in the /var/www/dev folder (OpenBSD web-server runs in chroot -u www /var/www)

mknod -m 666 null c 2 2
mknod -m 666 zero c 2 12
mknod -m 644 random 45 0
mknod -m 644 srandom 45 1
mknod -m 644 urandom 45 2
mknod -m 644 arandom 45 3

However, Python still reports that the

OSError: [Errno 6] Device not configured '/dev/urandom'

The same code works fine in a non-chroot-ed environment.

import os
import cgitb
cgitb.enable()

Given the advice on StackOverflow I run

chroot -u www /var/www dd if=/dev/urandom bs=16 count=1

and got the same result

dd: /dev/urandom: Device not configured

i.e. it's definitely a config error. Can anyone shed some light where I may be making a mistake? Any help would be truly appreciated!

share|improve this question
1  
Have you mounted /dev to your chroot environment using mount -o bind? This answer has a concise overview of why this is needed for dev –  jam Sep 16 '13 at 7:28
    
I tried doing that but OpenBSD does not have the option bind... Is there an equivalent? I read around and apparently one could do that with mount_null but that has been removed... Can I use mount -o sync /dev instead? –  TDrabas Sep 17 '13 at 0:19
1  
I found the culprit (partially...). It is not necessary to mount the device. In addition, as I mentioned before, in OpenBSD I couldn't find mount -o bind equivalent. Following the advice from comments from this site it is enough to mknod (as I have done earlier) and remove nodev from /etc/fstab where the system mounts \var. Although my script still does not work it no longer reports Device not configured –  TDrabas Sep 17 '13 at 5:04
1  
Just to finish off -- the _hashlib.so (called from import cgitb) depends on a shared library libcrypto.so. That was the problem with my script not running... Thanks all for your help! –  TDrabas Sep 17 '13 at 6:34
    
Glad you got it sorted, sorry if I led you down a linux-specific rabbit hole :) You can post that as an answer, it will let you accept it after a day or so I believe. –  jam Sep 17 '13 at 6:50

1 Answer 1

I found the culprit.

Following the advice from the comments section of this site it is enough to mknod (as I have done earlier) and remove nodev from /etc/fstab where the system mounts /var. This removes the 'no-devices' allowed flag in /var.

To make my script run I finally had to copy all the shared objects that Python's cgitb module (well, in fact, _hashlib.so) depends on -- namely libcrypto.so.

To find what your _hashlib.so depends on run ldd _hashlib.so -- mine is located in /usr/local/lib/python2.7/lib-dynload/_hashlib.so. Note -- you will find this library if you have OpenSSL installed on your system. If you don't, _hashlib.so loads e.g. _md5.so etc. that can only be find if you

  1. Don't have OpenSSL
  2. Configured and built Python with --with-pydebug flag (check this answer for more details)

Hope this helps!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.