Symbolic Link Error: Symbolic link is not allowed.

General discussion on Zend Server for IBM System i
Post Reply
davelhs03
Posts: 38
Joined: Mon Mar 30, 2009 6:20 pm
Contact:

Symbolic Link Error: Symbolic link is not allowed.

Post by davelhs03 » Wed Feb 22, 2012 6:37 pm

I keep getting the following 403 error via the browser:

Forbidden
Forbidden - by rule.

You do not have permission to access app1/symlinkeddir/ on this server.


I checked the zendsvr logs (/www/zendsvr/logs/error_log) and found this:

[error] [client <ipaddress>] ZSRV_MSG0046: Symbolic link /www/zendsvr/htdocs/myapps/app1/symlinkeddir is not allowed

I checked permissions to make sure QTMHHTTP has access to the target directory (/www/zendcore/htdocs/myapps/app1/symlinkeddir/).

I added this directive to the httpd.conf file

Code: Select all

<Directory /www/zendsvr/htdocs/myapps/app1/>
   Options FollowSymLinks
</Directory>
The symbolic link was created by:

Code: Select all

ADDLNK OBJ('/www/zendcore/htdocs/myapps/app1/symlinkeddir/') NEWLNK('/www/zendsvr/htdocs/myapps/app1/symlinkeddir/')
None of that fixed the error. Anyone else run into this issue? Is there something I'm missing.

Thanks for any help

David

aseiden
Posts: 875
Joined: Thu Apr 09, 2009 5:45 pm

Re: Symbolic Link Error: Symbolic link is not allowed.

Post by aseiden » Wed Feb 22, 2012 8:40 pm

Try WRKLNK then option 9 to check on folder permissions, both on the real folder and the symbolic link.

davelhs03
Posts: 38
Joined: Mon Mar 30, 2009 6:20 pm
Contact:

Re: Symbolic Link Error: Symbolic link is not allowed.

Post by davelhs03 » Wed Feb 22, 2012 8:55 pm

Real Folder

Code: Select all

Type . . . . . . . . . . . . . :   DIR       
Owner  . . . . . . . . . . . . :   QTMHHTTP  

             Data         --Object Authorities-- 
User      Authority  Exist  Mgt  Alter  Ref
QTMHHTTP    *RWX       X     X      X     X
Symbolic Link

Code: Select all

Type . . . . . . . . . . . . . :   DIR      
Owner  . . . . . . . . . . . . :   QTMHHTTP 

             Data         --Object Authorities-- 
User      Authority  Exist  Mgt  Alter  Ref
QTMHHTTP    *RWX        X    X     X     X
Seems normal.

davelhs03
Posts: 38
Joined: Mon Mar 30, 2009 6:20 pm
Contact:

Re: Symbolic Link Error: Symbolic link is not allowed.

Post by davelhs03 » Wed Feb 22, 2012 9:00 pm

My coworker the AS400 Guru sent me this link: http://www-912.ibm.com/s_dir/SLKBase.ns ... enDocument
This configuration will be demonstrated through the use of an example. It is important that the steps are followed in the order given. This setup is complicated because of the following:
o You cannot see what the authorities on a symbolic link are outside of the use of the Qp0lGetAttr API. If the WRKLNK, DSPAUT, or CHGAUT command is used, you are shown the authorities to the object pointed to by the symbolic link rather than the authorities on the symbolic link. In this case, that is a very important distinction.
o The authorities on a symbolic link are strictly inherited from the parent directory in which the link is created at the time the link is created. The final complication is that the authorities on a symbolic link cannot be changed once the link is created, there is no provision to do this in OS/400.
This paragraph seems to explain whats happening. The symbolic link's authority is hidden, unmodifiable and set when I called the ADDLNK commands. Looks like i have to remove the sym links, set the permissions on the parent directory and then re-create the symbolic links.

davelhs03
Posts: 38
Joined: Mon Mar 30, 2009 6:20 pm
Contact:

Re: Symbolic Link Error: Symbolic link is not allowed.

Post by davelhs03 » Wed Feb 22, 2012 11:39 pm

Symbolic links are still not working even-though QTMHHTTP has permissions and ownership of parent directory and target directory...

Did some digging and found that Zend uses a symbolic link for /www/zendsvr/htdocs/Zend5250Dispatcher. They also use QSECOFR as the owner of that symbolic link and public has all permissions... Not sure how safe that is...

Anyone have any experience with getting symbolic links to work using Zend Server for IBM i.

Post Reply