CentOS7中启动Apache加载mod_wsgi时权限拒绝问题求助

问题背景 #

在CentOS 7.9.2009虚拟机部署Flask，已安装Python3.8（源码编译）和mod_wsgi，执行sudo systemctl start httpd启动Apache时，出现mod_wsgi模块权限拒绝错误。

错误日志 #

httpd: Syntax error on line 56 of /etc/httpd/conf/httpd.conf: Syntax error on line 1 of /etc/httpd/conf.modules.d/02-wsgi.conf: Cannot load /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so into server: /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so: cannot open shared object file: Permission denied

已做操作 #

• 源码编译Python3.8，命令：./configure --enable-optimizations --enable-shared LDFLAGS="-Wl,-rpath /usr/local/lib"
• 配置文件信息：
  app.conf：

  LoadModule wsgi_module "/home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so"
  

  mod_wsgi-express module-config输出：

  [myuser@mycentos conf.d]$ mod_wsgi-express module-config
  LoadModule wsgi_module "/home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so"
  WSGIPythonHome "/usr/local"
  

排查方向与解决方案 #

1. 文件与目录权限问题 #

Apache运行用户为apache，默认无访问/home/myuser/.local目录的权限（用户家目录权限通常为700或750，限制其他用户访问）。

• 检查权限链：
  依次执行命令查看各层级目录及文件权限：

  ls -ld /home/myuser
  ls -ld /home/myuser/.local
  ls -ld /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server
  ls -l /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  

• 修复权限：
  给目录链添加其他用户执行权限（保证apache能遍历目录），给so文件添加读权限：

  chmod o+x /home/myuser
  chmod o+x /home/myuser/.local
  chmod o+x /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi
  chmod o+x /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server
  chmod o+r /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  

  更稳妥的方式是将mod_wsgi的so文件复制到Apache默认模块目录，再修改配置：

  sudo cp /home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so /usr/lib64/httpd/modules/
  sudo chown root:root /usr/lib64/httpd/modules/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  sudo chmod 755 /usr/lib64/httpd/modules/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  

  然后修改02-wsgi.conf中的加载路径：

  LoadModule wsgi_module modules/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  

2. SELinux限制 #

CentOS 7默认开启SELinux，即使文件权限正确，也可能阻止Apache访问用户家目录文件。

• 临时关闭SELinux测试：

  sudo setenforce 0
  

  重启Apache：sudo systemctl restart httpd，若能启动则说明是SELinux问题。
• 永久修复SELinux策略：
  给mod_wsgi的so文件添加httpd可读的SELinux上下文：

  sudo semanage fcontext -a -t httpd_modules_t "/home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so"
  sudo restorecon -v "/home/myuser/.local/lib/python3.8/site-packages/mod_wsgi/server/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so"
  

  若已将文件复制到系统模块目录，恢复默认上下文即可：

  sudo restorecon -v /usr/lib64/httpd/modules/mod_wsgi-py38.cpython-38-x86_64-linux-gnu.so
  

3. Python共享库权限问题 #

编译Python时启用了--enable-shared，需确保/usr/local/lib下的Python共享库（如libpython3.8.so）对apache用户有读权限：

ls -l /usr/local/lib/libpython3.8.so*

若权限不足，执行：

sudo chmod o+r /usr/local/lib/libpython3.8.so*

验证步骤 #

完成操作后执行以下步骤验证：

1. sudo systemctl start httpd
2. sudo systemctl status httpd，确认服务正常运行
3. 访问Flask应用URL，验证响应正常

内容的提问来源于stack exchange，提问作者MBasith