Client denied by server configuration

Question

I have set up an Apache server for the purpose of hosting gitolite. I've followed this guide, but when accessing the server I get a 403, and the apache error log contains this line:

[error] [client 192.168.0.97] client denied by server configuration: /var/www/bin/gitolite-suexec-wrapper.sh

As far as my understanding goes, this means the apache user can't open the wrapper script? Most pages detailing the "client denied by server configuration" message write about directories needing an Allow from all, but since the /var/www/bin/ directory isn't even supposed to be browsed, that shouldn't be the issue, I'd think?

The suexec part of the vhost config looks like this:

    SuexecUserGroup git git
    ScriptAlias /git/ /var/www/bin/gitolite-suexec-wrapper.sh/
    ScriptAlias /gitmob/ /var/www/bin/gitolite-suexec-wrapper.sh/

I'm running gitolite 3.5.2 and apache 2.2.25 on a gentoo 3.10.7 server. Apache is running under the user apache, and gitolite under git. These are the access rights for the suexec directories:

# ls -la /var/www/bin/ /var/www/git/
/var/www/bin/:
total 12
drwxr-xr-x 2 git    git  4096 Dec  9 21:26 .
drwxr-xr-x 5 apache root 4096 Dec  9 21:25 ..
-rwx------ 1 git    git   249 Dec  9 21:27 gitolite-suexec-wrapper.sh

/var/www/git/:
total 8
drwxr-xr-x 2 apache apache 4096 Dec  9 21:25 .
drwxr-xr-x 5 apache root   4096 Dec  9 21:25 ..

What more should I check?

Answer 1

I "fixed" it, though it feels like a hack to me. I added this

    <Directory /var/www/bin>
            Order allow,deny
            Allow from all
    </Directory>

... to the vhost config. I would have guessed that it should not really be necessary, since it is not an actual client request that opens this directory?

I also had to remap my git user and group, since suexec was compiled to force uid/gid > 1000, but the gentoo installer made them system accounts, which yielded a low id.