| Summary: | pulse is leaking a file descriptor | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Milos Malik <mmalik> | ||||
| Component: | piranha | Assignee: | Ryan O'Hara <rohara> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Cluster QE <mspqa-list> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 6.2 | CC: | cluster-maint, dwalsh, mjuricek | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | piranha-0.8.5-11.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-06-20 14:17:55 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Bug Depends On: | |||||||
| Bug Blocks: | 756082 | ||||||
| Attachments: |
|
||||||
|
Description
Milos Malik
2011-10-19 12:45:34 UTC
dontaudit candidate ? Yes, but should be fixed in pulse which is leaking. Two things:
* the test case which produces this particular error appears to be using fos - in fos.c, it's pretty clear that we don't close the lvs.cf prior to the run() function call; this is an easy fix. The catch is that since RHEL 2.1 we nave never supported fos mode of pulse.
* Piranha-gui spawns httpd, and has for the better part of 12 years used php to edit /etc/sysconfig/ha/lvs.cf - appears that is not working if you try to log in an edit the lvs.cf from piranha-gui (I think this is a separate issue, I don't know if it's a blocker or not):
type=AVC msg=audit(1319043483.057:3985): avc: denied { write } for pid=8524 comm="httpd" name="lvs.cf" dev=dm-0 ino=137226 scontext=unconfined_u:system_r:piranha_web_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1319043483.057:3985): arch=c000003e syscall=2 success=no exit=-13 a0=7fc8384a27c0 a1=2 a2=1b6 a3=21 items=0 ppid=8522 pid=8524 auid=0 uid=60 gid=60 euid=60 suid=60 fsuid=60 egid=60 sgid=60 fsgid=60 tty=(none) ses=168 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:piranha_web_t:s0 key=(null)
Created attachment 529060 [details]
Close fd after reading configuration file
(In reply to comment #6) > > * Piranha-gui spawns httpd, and has for the better part of 12 years used php to > edit /etc/sysconfig/ha/lvs.cf - appears that is not working if you try to log > in an edit the lvs.cf from piranha-gui ... is bug 746764 Nothing to see here. (In reply to comment #0) > Steps to Reproduce: > 1) get a fresh RHEL-6.2 machine > 2) yum -y install ipvsadm piranha setools-console policycoreutils-python > 3) run following automated test: > /CoreOS/selinux-policy/Regression/bz584451-piranha-and-ipvsadm Where do I find the test referenced in step #3? Created attachment 561701 [details]
lvs.cf file fos mode httpd
Here is an example lvs.cf file that can be used to control httpd in fos mode. This is useful for reproducing the problem and testing the fix. Be sure to replace IP_ADDRESS and ETH_DEVICE with appropriate values.
In this test, it is best to turn off any existing httpd services to avoid confusion. With httpd turned off, check that no httpd processes exist: # pidof httpd (no output) Using the lvs.cf file to control httpd is fos mode, start pulse: # service pulse start Starting pulse: [ OK ] This should start piranha in fos mode and start httpd as a failover service. Now look for the leaking file descriptor: # for a in `pidof httpd`; do ls -l /proc/$a/fd | grep lvs; done lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf lr-x------. 1 root root 64 Feb 13 17:14 3 -> /etc/sysconfig/ha/lvs.cf These file descriptors for lvs.cf should not exist. With patch, repeat the same test: # service pulse start Starting pulse: [ OK ] # pidof httpd 2821 2820 2819 2818 2817 2816 2815 2814 2812 We have 9 httpd processes, none should have file descriptor for lvs.cf: # for a in `pidof httpd`; do ls -l /proc/$a/fd | grep lvs; done (no output) This fixes the leaking file descriptor. I'll run the selinux test as soon as I get more information about how to do so. Fixed in piranha-0.8.5-11.el6. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0891.html |