Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
mod_revocator leaks a semaphore every time httpd stops
Version-Release number of selected component (if applicable):
mod_revocator-1.0.3-19.el7.x86_64
How reproducible:
always
Steps to Reproduce:
1. restart httpd a few times
2.
3.
Actual results:
number of semaphores owned by apache increases
Expected results:
steady state.
Additional info:
The only instance of marking the semaphore for removal is in the shutdown of crlhelper. If the helper is not enabled, or even if it is there is no assurance that it will reach the end of the main block before being killed by its parent.
The main code contains the comment
/* The semaphore is removed in the helper program. This is because that
* program survives Apache reloads so the semaphore will as well.
*/
but again does not take account of shutdowns.
The module is in the default configuration.
CRLEngine off
CRLAgeCheck off
CRLUpdateCritical off
CRLHelper /usr/libexec/crlhelper
Arguably the code should not be creating the semaphore if the CRLEngine is off.
(In reply to Martin Poole from comment #3)
> Arguably the code should not be creating the semaphore if the CRLEngine is
> off.
Agreed.
It seems a simple workaround is to remove the unused module.
To reproduce:
- yum install mod_revocator (this will pull in all deps)
- ipcs -s (confirm there are no apache semaphores)
- service httpd start
- service httpd stop
- ipcs -s
There will be 2 left-over semaphores. Remove them.
For example:
# ipcs -s
------ Semaphore Arrays --------
key semid owner perms nsems
0x00000000 17104896 apache 600 1
0x00000000 17235974 apache 600 1
# ipcrm -s 17104896
# ipcrm -s 17235974
# ipcs -s (confirm there are none)
Install updated mod_nss and mod_revocator packages
- service httpd start
- service httpd stop
- ipcs -s
There should be no semaphores
This is a baseline. You should also enable CRLEngine and configure a CRL and do additional testing to ensure that things are properly cleaned up a shutdown.
Similarly some basic mod_nss testing using some SSL urls would be appropriate as well, particularly with a pin-protected NSS database. This change for mod_nss affects the pin storage helper.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2016-2562.html
Description of problem: mod_revocator leaks a semaphore every time httpd stops Version-Release number of selected component (if applicable): mod_revocator-1.0.3-19.el7.x86_64 How reproducible: always Steps to Reproduce: 1. restart httpd a few times 2. 3. Actual results: number of semaphores owned by apache increases Expected results: steady state. Additional info: The only instance of marking the semaphore for removal is in the shutdown of crlhelper. If the helper is not enabled, or even if it is there is no assurance that it will reach the end of the main block before being killed by its parent. The main code contains the comment /* The semaphore is removed in the helper program. This is because that * program survives Apache reloads so the semaphore will as well. */ but again does not take account of shutdowns.