# Mod\_ruby, require, and $SAFE

**URL:** <https://www.ruby-forum.com/t/mod-ruby-require-and-safe/82956>\
**Category:** Ruby\
**Created:** [January 22, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/82956 "2007-01-22T18:22:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [January 22, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/82956/1 "2007-01-22T18:22:00Z")

</div>

When running under mod\_ruby with the default $SAFE == 1, a file  
containing only this:

require ‘active\_record’

will give a 500 response with the error:

mod\_ruby: error in ruby  
mod\_ruby: /usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:73:in  
`read': Insecure operation - read (SecurityError) mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/source_index.rb:73:in`load\_specification’  
mod\_ruby: from  
/usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:45:in  
`from_installed_gems' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/source_index.rb:44:in`from\_installed\_gems’  
mod\_ruby: from  
/usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:63:in  
`from_installed_gems' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems.rb:79:in`source\_index’  
mod\_ruby: from  
/usr/lib64/ruby/site\_ruby/1.8/rubygems/custom\_require.rb:105:in  
`init_gemspecs' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/custom_require.rb:50:in`initialize’  
mod\_ruby: from  
/usr/lib64/ruby/site\_ruby/1.8/rubygems/custom\_require.rb:24:in  
`require' mod_ruby: from /home/user/public_html/lvs/cgi/safe_test.rbx:1 mod_ruby: from /usr/lib64/ruby/1.8/apache/ruby-run.rb:53:in`handler’

I think this is happening because whatever is loaded from active\_record  
is tainted and then can’t be used to do the requires that active\_record  
needs to do. That could be way off though.

I’m aware of the RubySafeLevel apache directive, but is there a  
reasonable way to keep $SAFE == 1 and still be able to require  
active\_record?

Thanks,  
Jeremy