Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have asked this question on StackOverflow but given the comment there it seems like it fits here better.

This is almost certainly a system configuration issue—you didn't set up the jail right—rather than a Python one. You can test that very easily by just seeing what happens when you run, say, head -c16 /dev/urandom or dd if=/dev/urandom bs=16 count=1 from inside the jail. If you get the same error, go ask on SuperUser or ServerFault or another general Unix or OpenBSD forum. – abarnert

Here's what I've done:

I want to run some cgi scripts (written in Python) on my OpenBSD server. Since the web-server on OpenBSD runs in a jail I recreated the whole folder structure (/bin /dev /usr /usr/local/lib etc. etc.) but I'm still getting '500 Server Internal Error' when I'm trying to import some Python modules that require access to /dev/urandom device.

I have created the device special files using mknod.

ls -la /dev/*random
ls -la /dev/{null,zero}

I got the following output

crw-r--r--  1 root  wheel   45,   3 Sep 13 11:09 /dev/arandom
crw-r--r--  1 root  wheel   45,   0 Jul 15 19:02 /dev/random
crw-r--r--  1 root  wheel   45,   1 Jul 15 19:02 /dev/srandom
crw-r--r--  1 root  wheel   45,   2 Jul 15 19:02 /dev/urandom

and

crw-rw-rw-  1 root  wheel    2,   2 Sep 16 01:30 /dev/null
crw-rw-rw-  1 root  wheel    2,  12 Jul 15 19:02 /dev/zero

So I executed the following commands in the /var/www/dev folder (OpenBSD web-server runs in chroot -u www /var/www)

mknod -m 666 null c 2 2
mknod -m 666 zero c 2 12
mknod -m 644 random 45 0
mknod -m 644 srandom 45 1
mknod -m 644 urandom 45 2
mknod -m 644 arandom 45 3

However, Python still reports that the

OSError: [Errno 6] Device not configured '/dev/urandom'

The same code works fine in a non-chroot-ed environment.

import os
import cgitb
cgitb.enable()

Given the advice on StackOverflow I run

chroot -u www /var/www dd if=/dev/urandom bs=16 count=1

and got the same result

dd: /dev/urandom: Device not configured

i.e. it's definitely a config error. Can anyone shed some light where I may be making a mistake? Any help would be truly appreciated!

share|improve this question
1  
Have you mounted /dev to your chroot environment using mount -o bind? This answer has a concise overview of why this is needed for dev – jam Sep 16 '13 at 7:28
    
I tried doing that but OpenBSD does not have the option bind... Is there an equivalent? I read around and apparently one could do that with mount_null but that has been removed... Can I use mount -o sync /dev instead? – TDrabas Sep 17 '13 at 0:19
1  
I found the culprit (partially...). It is not necessary to mount the device. In addition, as I mentioned before, in OpenBSD I couldn't find mount -o bind equivalent. Following the advice from comments from this site it is enough to mknod (as I have done earlier) and remove nodev from /etc/fstab where the system mounts \var. Although my script still does not work it no longer reports Device not configured – TDrabas Sep 17 '13 at 5:04
1  
Just to finish off -- the _hashlib.so (called from import cgitb) depends on a shared library libcrypto.so. That was the problem with my script not running... Thanks all for your help! – TDrabas Sep 17 '13 at 6:34
    
Glad you got it sorted, sorry if I led you down a linux-specific rabbit hole :) You can post that as an answer, it will let you accept it after a day or so I believe. – jam Sep 17 '13 at 6:50

I found the culprit.

Following the advice from the comments section of this site it is enough to mknod (as I have done earlier) and remove nodev from /etc/fstab where the system mounts /var. This removes the 'no-devices' allowed flag in /var.

To make my script run I finally had to copy all the shared objects that Python's cgitb module (well, in fact, _hashlib.so) depends on -- namely libcrypto.so.

To find what your _hashlib.so depends on run ldd _hashlib.so -- mine is located in /usr/local/lib/python2.7/lib-dynload/_hashlib.so. Note -- you will find this library if you have OpenSSL installed on your system. If you don't, _hashlib.so loads e.g. _md5.so etc. that can only be find if you

  1. Don't have OpenSSL
  2. Configured and built Python with --with-pydebug flag (check this answer for more details)

Hope this helps!

share|improve this answer

I Had similar problem running Django in FreeBSD and OPENBSD. My problem was that the gunicorn process was running as root while the scripts were in outher users home/dir.

tl;dr -> check if the process is running with the right user

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .