Bug 492608
| Summary: | SELinux is preventing httpd startup via 'su -c' only | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Greg Metcalfe <gmetcalfe> | ||||
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> | ||||
| Status: | CLOSED DUPLICATE | QA Contact: | Ben Levenson <benl> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 10 | CC: | gmetcalfe | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i386 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2009-03-27 23:45:06 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Are you using kde? It is leaking open file descriptors. Yes I am, updated just before I found this issue. Well, except for sepostgresql, which I had to remove because it couldn't coexist with postgresql-server after the update. That's Bug 485510. kdebase-4.2.1-2.fc10.i386 kdelibs-4.2.1-4.fc10.i386 A file descriptor leak sounded like a good candidate as this machine is always on, and I'm a heavy konsole user. I rebooted, and repeated the test. Same result. I haven't tweaked /proc/sys/fs/file-max. It's 101836, as installed, and "grep 'descriptors' /var/log/messages" turns up nothing. ls /proc/$(pidof konsole)/fdinfo | wc -l 49 which seems a large number (35 sockets, 9 pipes), but I don't know what it should look like. All contexts are unconfined_u:unconfined_r:unconfined_t:s0. That's historical information, for others searching around in here. Continuing in that vein, 'file descriptor' was the piece of info I lacked. Searching around on KDE, I find https://bugs.kde.org/show_bug.cgi?id=180785 and https://bugs.kde.org/show_bug.cgi?id=183917 which was closed as a dupe, but contains half a dozen links back into the RH Bugzilla. Including: https://bugzilla.redhat.com/show_bug.cgi?id=480569 and your comment #4, which pretty much explains it. Thanks, Greg *** This bug has been marked as a duplicate of bug 484370 *** |
Created attachment 337040 [details] Text file exported from setroubleshoot. Description of problem: httpd starts normally if I'm already root, but 'su -c service httpd start' fails. Version-Release number of selected component (if applicable): Policy 23, httpd-2.2.11-2.fc10.i386 How reproducible: Allways. 3 tests. Steps to Reproduce: 1. Start/stop httpd as root. 2. Start/stop via 'su -c service httpd start' 3. Actual results: SELinux is preventing httpd (httpd_t) "read write" unconfined_t. Expected results: Normal httpd start. Additional info: $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 23 Policy from config file: targeted