Bug 459667

Summary: syslogd restart errors out with 'execvp: Permission denied'
Product: Red Hat Enterprise Linux 4 Reporter: Geoff Quelch <quelch>
Component: sysklogdAssignee: Peter Vrabec <pvrabec>
Status: CLOSED NOTABUG QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.7CC: theinric
Target Milestone: rc   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-08-27 09:54:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Output from the strace command.
none
Output from strace command on correct host none

Description Geoff Quelch 2008-08-20 23:08:28 UTC
Description of problem:
The syslogd is down and can't be restarted:
[root@npfbs00 log]# /etc/init.d/syslog start
Starting system logger: execvp: Permission denied
                                                           [FAILED]
Starting kernel logger:

Version-Release number of selected component (if applicable):
[root@npfbs00 log]# syslogd -v
syslogd 1.4.1

How reproducible:
Currently program is broken.

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Tomas Heinrich 2008-08-21 13:58:21 UTC
Hi Geoff,

what version of sysklogd are you using? Running "rpm -q sysklogd" would tell.
Does /var/log/audit/audit.log say anything about syslog?
Could you please run
  "strace -f -s 4096 -o /tmp/syslog.strace /etc/init.d/syslog start"
and attach the output file?

Comment 2 Geoff Quelch 2008-08-21 20:39:18 UTC
Thank you. Here is the information you requested.

[root@npws01 chkrootkit]# rpm -q sysklogd
sysklogd-1.4.1-44.el5

There is nothing in the audit logs concerning syslog.

Comment 3 Geoff Quelch 2008-08-21 20:40:24 UTC
Created attachment 314749 [details]
Output from the strace command.

The attached file is the output from the requeste command:

strace -f -s 4096 -o /tmp/syslog.strace /etc/init.d/syslog start

Thank you.

Comment 4 Geoff Quelch 2008-08-21 20:43:11 UTC
My apologies, my comments #2 and #3 should be discarded, I ran the command on the wrong host...

Here is the correct information:

[root@npfbs00 log]# rpm -q sysklogd
sysklogd-1.4.1-27.el4

There are no files in the audit directory.

Comment 5 Geoff Quelch 2008-08-21 20:45:19 UTC
Created attachment 314752 [details]
Output from strace command on correct host

Comment 6 Peter Vrabec 2008-08-25 12:38:27 UTC
Geoff, what does this command show?
#ls -Z /etc/init.d/syslog /sbin/rsyslog

Comment 7 Geoff Quelch 2008-08-25 16:07:55 UTC
Thanks, here is the info...

[root@npfbs00 tmp]# ls -Z /etc/init.d/syslog /sbin/rsyslog
ls: /sbin/rsyslog: No such file or directory
-rwxr-xr-x  root     root     system_u:object_r:initrc_exec_t  /etc/init.d/syslog

Comment 8 Peter Vrabec 2008-08-26 10:45:07 UTC
Ooops my fault.

again please:
#ls -Z /sbin/syslogd

Comment 9 Peter Vrabec 2008-08-26 10:49:17 UTC
Could you switch selinux into permissive mode for a while and start syslogd. Just to be sure it's not selinux related.

Comment 10 Geoff Quelch 2008-08-26 16:23:21 UTC
Thanks.
The revised command:

[root@npfbs00 tmp]# ls -Z /sbin/syslogd
-rwxr-xr-x  root     root     system_u:object_r:syslogd_exec_t /sbin/syslogd

Put selinux in permissive mode...

[root@npfbs00 tmp]# /etc/init.d/syslog start
Starting system logger:                                    [  OK  ]
Starting kernel logger:

Thanks.

Comment 11 Peter Vrabec 2008-08-27 09:54:41 UTC
hmm, it seems you have problem with selinux here. Check you /var/log/messages. Relabeling your filesystem might be useful. 
touch /.autorelabel
reboot