Bug 842487

Description of problem:

systemctl start cobblerd fails because python can't find pam_start. However, cobblerd can be started manually but then more errors are thrown by "cobbler check". 

This seems possibly related to bug 837161 and bug 827813 although the fix in those bugs (selinux-policy update) is in place.

Version-Release number of selected component (if applicable):
cobbler-2.2.3-2.fc17.noarch
python-2.7.3-6.fc17.x86_64
selinux-policy-3.10.0-140.fc17.noarch

How reproducible:
always

Steps to Reproduce:
1. install fc17
2. yum -y install cobbler cobbler-web
3. yum -y upgrade
4. systemctl start cobblerd
5. /usr/bin/cobblerd
  
Actual results:

cobblerd doesn't start via systemctl

Expected results:

cobblerd should start via systemctl

Additional info:

[root@fc17vm alan]# systemctl start cobblerd.service
[root@fc17vm alan]# systemctl status cobblerd.service
cobblerd.service - Cobbler Helper Daemon
	  Loaded: loaded (/usr/lib/systemd/system/cobblerd.service; enabled)
	  Active: active (exited) since Mon, 23 Jul 2012 20:49:38 -0400; 39min ago
	Main PID: 1094 (code=exited, status=0/SUCCESS)
	  CGroup: name=systemd:/system/cobblerd.service

Jul 23 20:49:38 fc17vm cobblerd[1094]: module_loader.load_modules()
Jul 23 20:49:38 fc17vm cobblerd[1094]: File "/usr/lib/python2.7/site-packages/cobbler/module_loader.py", line 62, in load_modules
Jul 23 20:49:38 fc17vm cobblerd[1094]: blip =  __import__("modules.%s" % ( modname), globals(), locals(), [modname])
Jul 23 20:49:38 fc17vm cobblerd[1094]: File "/usr/lib/python2.7/site-packages/cobbler/modules/authn_pam.py", line 121, in <module>
Jul 23 20:49:38 fc17vm cobblerd[1094]: PAM_START = LIBPAM.pam_start
Jul 23 20:49:38 fc17vm cobblerd[1094]: File "/usr/lib64/python2.7/ctypes/__init__.py", line 373, in __getattr__
Jul 23 20:49:38 fc17vm cobblerd[1094]: func = self.__getitem__(name)
Jul 23 20:49:38 fc17vm cobblerd[1094]: File "/usr/lib64/python2.7/ctypes/__init__.py", line 378, in __getitem__
Jul 23 20:49:38 fc17vm cobblerd[1094]: func = self._FuncPtr((name_or_ordinal, self))
Jul 23 20:49:38 fc17vm cobblerd[1094]: AttributeError: /usr/bin/python: undefined symbol: pam_start

[root@fc17vm alan]# /usr/bin/cobblerd
[root@fc17vm alan]# ps ax | grep cobblerd
20738 ?        S      0:00 /usr/bin/python /usr/bin/cobblerd
20740 pts/0    S+     0:00 grep --color=auto cobblerd
[root@fc17vm alan]# cobbler check
httpd does not appear to be running and proxying cobbler, or SELinux is in the way. Original traceback:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/cobbler/cli.py", line 184, in check_setup
    s.ping()
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1224, in __call__
    return self.__send(self.__name, args)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1578, in __request
    verbose=self.__verbose
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1264, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1312, in single_request
    response.msg,
ProtocolError: <ProtocolError for 127.0.0.1:80/cobbler_api: 503 Service Temporarily Unavailable>
[root@fc17vm alan]# 

---

once cobblerd is launched manually and a "cobbler check" is performed, get this:

[root@fc17vm alan]# cobbler check
httpd does not appear to be running and proxying cobbler, or SELinux is in the way. Original traceback:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/cobbler/cli.py", line 184, in check_setup
    s.ping()
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1224, in __call__
    return self.__send(self.__name, args)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1578, in __request
    verbose=self.__verbose
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1264, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1312, in single_request
    response.msg,
ProtocolError: <ProtocolError for 127.0.0.1:80/cobbler_api: 503 Service Temporarily Unavailable>

[root@fc17vm alan]# grep cobbler /var/log/audit/audit.log | audit2why
WARNING: Policy would be downgraded from version 27 to 26.
type=AVC msg=audit(1343091333.707:93): avc:  denied  { name_connect } for  pid=1382 comm="httpd" dest=25151 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:cobbler_port_t:s0 tclass=tcp_socket

	Was caused by:
	One of the following booleans was set incorrectly.
	Description:
	httpd_can_network_connect_cobbler

	Allow access by executing:
	# setsebool -P httpd_can_network_connect_cobbler 1
	Description:
	httpd_can_network_connect

	Allow access by executing:
	# setsebool -P httpd_can_network_connect 1
type=AVC msg=audit(1343093480.865:111): avc:  denied  { name_connect } for  pid=1383 comm="httpd" dest=25151 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:cobbler_port_t:s0 tclass=tcp_socket

	Was caused by:
	One of the following booleans was set incorrectly.
	Description:
	httpd_can_network_connect_cobbler

	Allow access by executing:
	# setsebool -P httpd_can_network_connect_cobbler 1
	Description:
	httpd_can_network_connect

	Allow access by executing:
	# setsebool -P httpd_can_network_connect 1