Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I wrote a simple PHP file which calls a java application.

It runs on cli without problems but I can't run it on browser.

Output:

"Java HotSpot(TM) 64-Bit Server VM warning: INFO:os::commit_memory(0x00007ff590053000, 2555904, 1) failed; error='Permission denied' (errno=13) 
# # There is insufficient memory for the Java Runtime Environment to continue. 
# Native memory allocation (malloc) failed to allocate 2555904 bytes for committing reserved memory. 
# An error report file with more information is saved as: # /tmp/hs_err_pid14930.log "

How can I fix it?

share|improve this question
    
Add the code your PHP application –  Anton Dozortsev Feb 15 at 8:44
    
I've resolved problem. It is memory protection by SELINUX. –  monkey Feb 15 at 9:11

2 Answers 2

It looks like you're hitting the maximum memory limit: Java is asking for around 2.5mb and cannot get it. Strange it's not that much, but most probably doens't include the JRE image itself so it will be much more.

Check and/or rise the PHP memory limit (/etc/php.ini), something like :

memory_limit = 128M

Depending on the configuration you could do it also in the .php itself:

ini_set('memory_limit', '128M');

In case posting the /tmp/hs_err_pid14930.log the error is refeering to would be very helpful aswell!

share|improve this answer
    
I set like you. But it still has problem. And I have 2GB free and 4GB swap on system. May be Apache limit it. –  monkey Feb 14 at 7:48
    
It's not about free RAM/Swap but really about a limit on who spawns your process. Try with a higer even limit in case you have doubts (put 256 or 512 or so). Remember to restart apache every time just in case. Send also that log in /tmp in case so we can help more. –  fede.evol Feb 14 at 8:05
    
Thank you. I see the log is the same this message. I switch to a Windows machine. Set up all with default options (WAMPP, Java...) -> It works. I will try to fix it in Linux (may be java version, ulimit or somethings else) –  monkey Feb 14 at 8:59

In case anyone else is looking for a way to resolve this without explicitly disabling SELinux, the wiki page at centos.org helped me understand what was going on.

By default, the security context that Java is running in when called from Apache does not allow things like reading a file, allocating memory, accessing the network etc. The easiest way to resolve these errors is by using the semodule and audit2allow applications. Essentially, check the SELinux audit log (could be /var/logs/audit/audit.log, but I used /var/log/messages and extracted the avc errors). In the log you should see things like

avc: denied { getattr } for pid=21415 comm="java"

and

avc: denied { open } for pid=21319 comm="java"

In fact, you will see quite a few about executing, memory allocation and a number of other policies you are violating as SELinux is set to enforcing and stopping the application from running.

With your audit log run audit2allow as below:

audit2allow -M myapppolicy < audit.log

Where myapppolicy is the name of the policy you want to create that will allow all the things that have been denied in the log and audit.log is the name of the log file described above. After you run this command, two files should be created. The first is myapppolicy.te which is a text representation of the policy based on the audit log. You can open this in a text editor and ensure your policy is not too broad. The second file is the myapppolicy.pp file which is the compiled policy package that you can enable.

Run the following to make the policy package active and then retry your process. You may have multiple tries at this to get everything working as expected as your Java app may violate some other policy after it gets access to the first one. I execute these steps about five times for a series of Java apps that I was running via script via php.

semodule -i myapppolicy.pp

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.