6

I installed varnish from epel repo on a CentOS 6.7, and it fails to start with following error :

Compiled VCL program failed to load:
  ./vcl.1P9zoqAU.so: failed to map segment from shared object: Operation not permitted
VCL compilation failed

If I strace the varnishd binary, I get following lines by the end

chdir("/var/lib/varnish/myserver.foo.bar") = 0
open("./vcl.1P9zoqAU.c", O_RDWR|O_CREAT|O_EXCL, 0600) = 3

So I checked that permissions were right on this directory (plus I'm running it with root), I disabled SELinux, rebooted, reinstalled... First it happened with varnish 2.1.15, but same is happening with 4.0.3 (using official varnish repo).

Do you have any idea what is going on on my system ?

Guillaume Fenollar
  • 737
  • 7
  • 9
  • Can you check to ensure that the file system isn't mounted with `noexec`? – Anya Shenanigans Mar 09 '16 at 13:54
  • Omg, that was the reason... Can you explain (in an topic answer) why a noexec option has an impact on a basic open() operation ? From what I understand, varnish is now trying to build vcl configuration in C so it can be loaded in memory. I'm not sure where the noexec here was interfering. Thank you for your help – Guillaume Fenollar Mar 09 '16 at 14:00

1 Answers1

7

As part of varnish's startup, it generates a loadable library of the configuration of it's behaviour. This gets compiled and loaded at run-time by varnishd. This is the thing that is being complained about with the error:

Compiled VCL program failed to load:
  ./vcl.1P9zoqAU.so: failed to map segment from shared object: Operation not permitted
VCL compilation failed

i.e. it's a dlopen call that's failing. The newer version has a slightly more obvious message where it says:

dlopen(vcl_boot/vgc.so) = failed to map segment from shared object: Operation not permitted

In this case, the directory that the .so is placed in resides on a filesystem that is mounted with the noexec option, which causes the dlopen to fail.

Addressing this requires remounting this file system with the exec option.

Anya Shenanigans
  • 91,618
  • 3
  • 107
  • 122
  • You can do this on Ubuntu by changing the /etc/fstab configuration to: /tmp ext4 defaults,exec,nosuid,nodev – Joe Hyde Mar 28 '16 at 04:27
  • 1
    Thanks for this. Note for this using docker and a tmpfs you just need to add `:exec` on the end of the volume to add the exec option. – dalore May 28 '19 at 18:37
  • Wonder if it is possible to use a different directory for this compilation step? – Jonas Berlin Jul 23 '20 at 09:23