centos httpd升级mod_wsgi-4.7.1避坑指南

系统 centos7.5  httpd 2.4.46

系统安全扫描如下问题【1】mod_wsgi for Apache 本地提权漏洞(CVE-2014-8583) 

                                    【2】mod_wsgi for Apache 权限许可和访问控制漏洞(CVE-2014-0240)

阅读解决建议后，要求升级4.2.4流量说明后发现最新版本4.7.1，索性直接升级最新版本！https://modwsgi.readthedocs.io/en/latest/release-notes/version-4.7.1.html

## 解压缩
tar zxvf mod_wsgi-4.7.1.tar.gz
-----------------------
## 进入目录
cd mod_wsgi-4.7.1/
ls
-----------------------
configure     CREDITS.rst  images   Makefile.in  package.sh         README.rst             setup.py  tests    win32
configure.ac  docs         LICENSE  MANIFEST.in  pyproject.toml.in  README-standalone.rst  src       tox.ini

## 查看python3对应的位置
[root@ mod_wsgi-4.7.1]whereis python3
-----------------------
python3: /home/liushu/anaconda3/bin/python3 

## 查看 apx对于位置
[root@ mod_wsgi-4.7.1]which apxs
-----------------------
/usr/bin/apxs

[root@ mod_wsgi-4.7.1]./configure -with-python=/home/liushu/anaconda3/bin/python3 --with-apxs=/usr/bin/apxs
-----------------------
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for prctl... yes
checking Apache version... 2.4.46
configure: creating ./config.status
config.status: creating Makefile

[root@ mod_wsgi-4.7.1]make
-----------------------
/usr/bin/apxs -c -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -Wc,-g -Wc,-O2  src/server/mod_wsgi.c src/server/wsgi_*.c -L/home/liushu/anaconda3/lib -L/home/liushu/anaconda3/lib/python3.8/config  -lpython3.8 -lpthread -ldl -lutil -lrt -lm
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/mod_wsgi.lo src/server/mod_wsgi.c && touch src/server/mod_wsgi.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_apache.lo src/server/wsgi_apache.c && touch src/server/wsgi_apache.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_buckets.lo src/server/wsgi_buckets.c && touch src/server/wsgi_buckets.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_convert.lo src/server/wsgi_convert.c && touch src/server/wsgi_convert.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_daemon.lo src/server/wsgi_daemon.c && touch src/server/wsgi_daemon.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_interp.lo src/server/wsgi_interp.c && touch src/server/wsgi_interp.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_logger.lo src/server/wsgi_logger.c && touch src/server/wsgi_logger.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_memory.lo src/server/wsgi_memory.c && touch src/server/wsgi_memory.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_metrics.lo src/server/wsgi_metrics.c && touch src/server/wsgi_metrics.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_restrict.lo src/server/wsgi_restrict.c && touch src/server/wsgi_restrict.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_server.lo src/server/wsgi_server.c && touch src/server/wsgi_server.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_stream.lo src/server/wsgi_stream.c && touch src/server/wsgi_stream.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_thread.lo src/server/wsgi_thread.c && touch src/server/wsgi_thread.slo
/usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -I/opt/codeit/openssl111/include  -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1  -g -O2 -I/home/liushu/anaconda3/include/python3.8 -DNDEBUG  -c -o src/server/wsgi_validate.lo src/server/wsgi_validate.c && touch src/server/wsgi_validate.slo
/usr/lib64/apr-1/build/libtool --silent --mode=link gcc -std=gnu99 -Wl,-z,relro,-z,now   -o src/server/mod_wsgi.la  -rpath /usr/lib64/httpd/modules -module -avoid-version    src/server/wsgi_validate.lo src/server/wsgi_thread.lo src/server/wsgi_stream.lo src/server/wsgi_server.lo src/server/wsgi_restrict.lo src/server/wsgi_metrics.lo src/server/wsgi_memory.lo src/server/wsgi_logger.lo src/server/wsgi_interp.lo src/server/wsgi_daemon.lo src/server/wsgi_convert.lo src/server/wsgi_buckets.lo src/server/wsgi_apache.lo src/server/mod_wsgi.lo -L/home/liushu/anaconda3/lib -L/home/liushu/anaconda3/lib/python3.8/config -lpython3.8 -lpthread -ldl -lutil -lrt -lm


[root@ mod_wsgi-4.7.1]make install
-----------------------
/usr/bin/apxs -i -S LIBEXECDIR=/usr/lib64/httpd/modules -n 'mod_wsgi' src/server/mod_wsgi.la
/usr/lib64/httpd/build/instdso.sh SH_LIBTOOL='/usr/lib64/apr-1/build/libtool' src/server/mod_wsgi.la /usr/lib64/httpd/modules
/usr/lib64/apr-1/build/libtool --mode=install install src/server/mod_wsgi.la /usr/lib64/httpd/modules/
libtool: install: install src/server/.libs/mod_wsgi.so /usr/lib64/httpd/modules/mod_wsgi.so
libtool: install: install src/server/.libs/mod_wsgi.lai /usr/lib64/httpd/modules/mod_wsgi.la
libtool: install: install src/server/.libs/mod_wsgi.a /usr/lib64/httpd/modules/mod_wsgi.a
libtool: install: chmod 644 /usr/lib64/httpd/modules/mod_wsgi.a
libtool: install: ranlib /usr/lib64/httpd/modules/mod_wsgi.a
libtool: finish: PATH="/home/liushu/anaconda3/bin:/home/liushu/anaconda3/condabin:/home/liushu/soft/openssl-1.1.1i/apps:/home/liushu/anaconda3/bin:/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/sbin" ldconfig -n /usr/lib64/httpd/modules
==========================================================
Libraries have been installed in:
   /usr/lib64/httpd/modules

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
     during execution
   - add LIBDIR to the `LD_RUN_PATH' environment variable
     during linking
   - use the `-Wl,-rpath -Wl,LIBDIR' linker flag
   - have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
==========================================================
chmod 755 /usr/lib64/httpd/modules/mod_wsgi.so
[root@ mod_wsgi-4.7.1]# 

安装成功后 在httpd.conf 文件中添加如下内容：

[root@ mod_wsgi-4.7.1] vim /etc/httpd/conf/httpd.conf
--------------------------------->添加如下内容
LoadModule wsgi_module /usr/lib64/httpd/modules/mod_wsgi.so

 

重启 httpd，发现失败，报错！

[root@sp mod_wsgi-4.7.1]# systemctl restart httpd
-------------------------------------
Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

# systemctl status httpd -l  显示完全错误信息，发现提示：Cannot load XAAA into server:XBBB : cannot open shared object file:No such file or directory

检查是否有mod_wsgi.so

[root@sp] find / -name mod_wsgi.so
-----------------------------------
/home/liushu/install_package/mod_wsgi-4.7.1/src/server/.libs/mod_wsgi.so
/usr/lib64/httpd/modules/mod_wsgi.so

检查是否有 libpython3.8.so.1.0 

 [root@sp] find / -name libpython3.8.so.1.0
/home/liushu/anaconda3/pkgs/python-3.8.3-hcff3b4d_2/lib/libpython3.8.so.1.0
/home/liushu/anaconda3/lib/libpython3.8.so.1.0
[root@sp]# 

修改 /etc/ld.so.conf文件

 vi /etc/ld.so.conf
-----------------------

重新加载并且 重启 httpd进程

[root@sp] ldconfig
[root@sp]#
[root@sp] systemctl restart httpd
[root@sp]

成功启动httpd！