Permission Denied on AWS Elastic Beanstalk

[NorCalDavid]

Issue description

I have everything configured and properly functioning to create the PDF on localhost but it crashes on AWS Elastic Beanstalk.

Error Message: [31401a2e-2d53-4b5d-8c66-81a1fc83f7ff] RuntimeError (Failed to execute: ["/opt/rubies/ruby-2.6.5/bin/wkhtmltopdf", "--print-media-type", "--orientation", "Portrait", "--page-size", "Letter", "file:////tmp/wicked_pdf20200505-10084-r9asae.html", "/tmp/wicked_pdf_generated_file20200505-10084-1ep8p6o.pdf"] Error: PDF could not be generated! Command Error: /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:in initialize': Permission denied @ rb_sysopen - /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf_centos_6_amd64 (Errno::EACCES) from /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:inopen' from /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:in <top (required)>' from /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf:23:inload' from /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf:23:in `

' ): [31401a2e-2d53-4b5d-8c66-81a1fc83f7ff]

I am able to SSH into the instance and when I run which wkhtmltopdf it returns this: /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf

Expected or desired behavior

System specifications

AWS Elastic Beanstalk - Puma with Ruby 2.6 running on 64bit Amazon Linux/2.11.4

wicked_pdf gem version (output of cat Gemfile.lock | grep wicked_pdf): wicked_pdf (2.0.2)

wkhtmltopdf version (output of wkhtmltopdf --version):

[ current]$ wkhtmltopdf --version Traceback (most recent call last): 4: from /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf:23:in <main>' 3: from /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf:23:inload' 2: from /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:in <top (required)>' 1: from /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:inopen' /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf:39:in `initialize': Permission denied @ rb_sysopen - /opt/rubies/ruby-2.6.5/lib/ruby/gems/2.6.0/gems/wkhtmltopdf-binary-0.12.5.4/bin/wkhtmltopdf_centos_6_amd64 (Errno::EACCES)

[unixmonkey]

Is the user you execute wkhtmltopdf as when you SSH in, the same user your application runs as? It seems like that might be the difference.

[NorCalDavid]

That makes sense for the error when I attempt to check the version but I was using the wkhtmltopdf-binary gem that installed by the application but it is giving the permission denied error from the application. I did attempt to use a ebextensions.config file to install wkhtmltopdf when the instance is created but it was not working and I have an AWS engineer looking into that. But I don't think that the wkhtmltopdf that is running on the server is the version that was installed by the config because it is located as a ruby gem in this location: /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf

This is the contents of the eb config file: commands: 03_command: command: yum install --assumeyes zlib fontconfig freetype X11 test: test ! -f .wkhtmltopdf 04_command: command: wget https://downloads.wkhtmltopdf.org/0.12/0.12.4/wkhtmltox-0.12.4_linux-generic-amd64.tar.xz test: test ! -f .wkhtmltopdf 05_command: command: tar -xJf wkhtmltox-0.12.4_linux-generic-amd64.tar.xz test: test ! -f .wkhtmltopdf 06_command: command: cp wkhtmltox/bin/wkhtmltopdf /usr/local/bin/wkhtmltopdf test: test ! -f .wkhtmltopdf 07_command: command: cp wkhtmltox/bin/wkhtmltoimage /usr/local/bin/wkhtmltoimage test: test ! -f .wkhtmltopdf 08_command: command: touch .wkhtmltopdf

But the directory that it is supposed to install in does not exist so this is not functioning properly. I have AWS working on this. But since wkhtmltopdf is running on the server my hope is that I just missed something with the config.

[NorCalDavid]

Is the user you execute wkhtmltopdf as when you SSH in, the same user your application runs as? It seems like that might be the difference.

To answer this question, No there are different IAM credentials for the application and the SSH user. I can't wrap my arms around why the application that installed wkhtmltopdf through the gem does not have permission.

[unixmonkey]

I think it may be related to the binary at /opt/rubies/ruby-2.6.5/bin/wkhtmltopdf actually being a Ruby binstub, which itself shells out to Ruby to find and execute the right C binary for wkhtmltopdf, and the version of Ruby may not be the same version of Ruby inside your app. And the user that runs it when shelled out, may not be the user that the app runs as.

If you extract out the actual binary you need and run it directly, you may have a different result than trying to run it through the gem.

Try copying it out the right binary for your platform and specifying the direct path to that, rather than having the gem choose for you, and see if that makes a difference.

If you have trouble finding them in your gem files, you can download from here: https://github.com/zakird/wkhtmltopdf_binary_gem/tree/master/bin

Let me know how it goes!

[gustavoelizalde]

@NorCalDavid I'm having the exact same issue... did you find a way to make it work on ElasticBeanstalk?

[alkevintan]

I'm also having the same issue. I tried specifying the exact version as @unixmonkey suggested but I still seem to be having the same permission error.

[alkevintan]

After hours of googling, I found this.

sudo /sbin/ldconfig -v

Running this fixed my issues.

[cheldasan]

I had the same problem. In our case, it happened when we raised the gem version from 0.12.3.1 to 0.12.6.2.

Therefore, we are fixing the gem version to 0.12.3.1 as a temporary solution.

ruby: 2.4.3

[ahaverty]

sudo chmod -R 777 /var/app/current/vendor/bundle/ruby/*/gems/wkhtmltopdf-binary-*

Giving wkhtmltopdf-binary full write permissions fixes this for me (🤷 ).

---

My relevant wicked_pdf setup for reference, on Elastic Beanstalk (Ruby 2.6 running on 64bit Amazon Linux 2/3.1.0):

Gemfile

gem "wicked_pdf", "~> 2.1.0"
gem "wkhtmltopdf-binary", "~> 0.12.6.3"

.platform/confighooks/postdeploy/01_wickedpdf_permissions.sh & .platform/hooks/postdeploy/01_wickedpdf_permissions.sh (I gave up testing the elastic beanstalk lifecycle, so I've added it to both postdeploys and hit both current and staging)

#!/bin/sh
sudo chmod -R 777 /var/app/current/vendor/bundle/ruby/*/gems/wkhtmltopdf-binary-*
sudo chmod -R 777 /var/app/staging/vendor/bundle/ruby/*/gems/wkhtmltopdf-binary-* || true

.platform/hooks/prebuild/01_install_libpng12.sh

#!/bin/sh
yum install -y libpng12.x86_64

[remycardoen]

Anyone found the solution? Just migrated from DigitalOcean where this gem worked fine, and in Elastick Beanstalk AWS I am facing this issue.

[remycardoen]

I had the same problem. In our case, it happened when we raised the gem version from 0.12.3.1 to 0.12.6.2.

Therefore, we are fixing the gem version to 0.12.3.1 as a temporary solution.

ruby: 2.4.3

I did the same and then it started to work, maybe this will be fixed in later versions? Previously I had the 0.12.6.5 and changed to 0.12.3.1

[rylanb]

It is truly unfortunate that we are stuck on this older version of wicked pdf / wkhtmltopdf due to the local access issue. I thought I was able to upgrade properly, it somehow worked and then went right back to:

Error: PDF could not be generated!
 Command Error: /var/app/current/vendor/bundle/ruby/2.7.0/gems/wkhtmltopdf-binary-0.12.6.6/bin/wkhtmltopdf:63:in `initialize': Permission denied @ rb_sysopen - /var/app/current/vendor/bundle/ruby/2.7.0/gems/wkhtmltopdf-binary-0.12.6.6/bin/wkhtmltopdf_centos_7_amd64 (Errno::EACCES)

A most frustrating experience.

Pinned wkhtmltopdf-binary back to gem 'wkhtmltopdf-binary', '0.12.3.1' and that seemed to fix it.

I appreciate folks working on OS and all, though. Thank you.

[jwcatprint]

If you are using the lastest version of Amazon Linux 2023 on Elastic Beanstalk, it does not include the libpng12 or openssl10 packages required. You can work around this by using the platform hooks.

.platform/postdeploy/01_wickedpdf.sh

#!/bin/sh
sudo chmod -R 777 /var/app/current/vendor/bundle/ruby/*/gems/wkhtmltopdf-binary-*
sudo chmod -R 777 /var/app/staging/vendor/bundle/ruby/*/gems/wkhtmltopdf-binary-* || true
sudo chmod -R 777 /usr/share/ruby*-gems/gems/wkhtmltopdf-binary-*

.platform/prebuild/01_install_libpng.sh

#!/bin/sh
mkdir -p ~/src

cd ~/src

if [ "rpm -qa | grep libpng12" == "" ]; then
  wget https://cdn.amazonlinux.com/2/core/2.0/x86_64/6b0225ccc542f3834c95733dcf321ab9f1e77e6ca6817469771a8af7c49efe6c/../../../../../blobstore/20c9cb4a31041ea98bfdaa7ed64b6e944c8893ce0e1f00da92d0a3fd2116f363/libpng12-1.2.50-10.amzn2.x86_64.rpm
  sudo rpm -i libpng12-1.2.50-10.amzn2.x86_64.rpm 
fi

if [ "rpm -qa | grep compat-openssl10" == "" ]; then
  wget https://rpmfind.net/linux/centos/8-stream/AppStream/x86_64/os/Packages/compat-openssl10-1.0.2o-3.el8.x86_64.rpm
  sudo rpm -i compat-openssl10-1.0.2o-3.el8.x86_64.rpm
fi

[bmckibben]

I am also having this issue. I recently moved an application to elastic beanstalk. Puma, Ruby 3.2.2, Rails 7.1.3, wicked_pdf 2.8.0, wkhtmltopdf-binary 0.12.6.7

I'll try out the workaround suggested by jwcatprint .

[jwcatprint]

My script does not seem to work on deploy properly.

But the commands inside the conditions to install the missing packages does work if you install them directly on the server.

If you do figure out the right syntax for my script please share as I have not had time to go back and debug!

[sriram2520]

Here's my setup which I got working today on beanstalk platform Ruby 3.2 running on 64bit Amazon Linux 2023/4.0.8

You will notice few things repeating, since I wasnt sure where in Beanstalk lifecycle to configure these, I pretty much repeated them everywhere.

1. Gemfile

ruby "3.2.2"
gem "rails", "~> 7.0.5"

gem 'wicked_pdf', '2.7.0'
gem 'wkhtmltopdf-binary'

2. Gemfile.lock

wicked_pdf (2.7.0)
    activesupport
wkhtmltopdf-binary (0.12.6.7)

3. .ebextensions/01_ruby.config

packages:
  yum:
    git: []

container_commands:
  01_install_bundler:
    command: "gem install bundler -v 2.4.17"
  02_set_bundle_path:
    command: "bundle config set --local path /build/gems"
  03_set_tmp_permissions:
    command: "chmod 0777 -f /var/app/current/tmp | :"
  04_install_openssl:
    command: "yum localinstall -y https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/compat-openssl11-1.1.1k-4.el9.x86_64.rpm"

commands:
  01_install_bundler:
    command: "gem install bundler -v 2.4.17"
  02_set_tmp_permissions:
    command: "chmod 0777 -f /var/app/current/tmp | :"
  03_install_openssl:
    command: "yum localinstall -y https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/compat-openssl11-1.1.1k-4.el9.x86_64.rpm"

4. .platform/hooks/prebuild/01_config_bundle_gem_path.sh

#!/bin/sh
mkdir -p /build/gems
bundle config set --local path /build/gems

5. .platform/hooks/prebuild/03_install_libpng.sh

#!/bin/sh
mkdir -p ~/src

cd ~/src

if [ "rpm -qa | grep libpng12" == "" ]; then
  wget https://cdn.amazonlinux.com/2/core/2.0/x86_64/6b0225ccc542f3834c95733dcf321ab9f1e77e6ca6817469771a8af7c49efe6c/../../../../../blobstore/20c9cb4a31041ea98bfdaa7ed64b6e944c8893ce0e1f00da92d0a3fd2116f363/libpng12-1.2.50-10.amzn2.x86_64.rpm
  sudo rpm -i libpng12-1.2.50-10.amzn2.x86_64.rpm 
fi

6. .platform/hooks/postdeploy/01_wickedpdf_permissions.sh

#!/bin/sh
sudo chmod -Rf 777 /build/gems/ruby/*/gems/wkhtmltopdf-binary-*
sudo chmod -Rf 777 /var/app/current/tmp | :
if find /build/gems/ruby/ -path "*/gems/wkhtmltopdf-binary-*/bin/wkhtmltopdf_centos_8_amd64.gz" | grep -q .; then
  gzip -d /build/gems/ruby/*/gems/wkhtmltopdf-binary-*/bin/wkhtmltopdf_centos_8_amd64.gz
else
  echo "skipping gzip since wkhtml gz file not found"
fi

Apart from the above, since I use wkhtmltopdf-binary gem, it points to centos 6 binary. Centos 6 version depends on libssl 1.0 which I couldn't find on https://rpmfind.net/

So I had to set the environment variable WKHTMLTOPDF_HOST_SUFFIX to the value centos_8_amd64 to force it to use the centos 8 binary and install libssl 1.1

[gustavoelizalde]

For some reason I'm getting this error

error: libpng12-1.2.50-10.amzn2.x86_64.rpm: not an rpm package (or package manifest):