Hide Forgot
Description of problem: mod_revocator leaks a semaphore every time httpd stops Version-Release number of selected component (if applicable): mod_revocator-1.0.3-19.el7.x86_64 How reproducible: always Steps to Reproduce: 1. restart httpd a few times 2. 3. Actual results: number of semaphores owned by apache increases Expected results: steady state. Additional info: The only instance of marking the semaphore for removal is in the shutdown of crlhelper. If the helper is not enabled, or even if it is there is no assurance that it will reach the end of the main block before being killed by its parent. The main code contains the comment /* The semaphore is removed in the helper program. This is because that * program survives Apache reloads so the semaphore will as well. */ but again does not take account of shutdowns.
Am I reading this correctly, the module isn't configured?
The module is in the default configuration. CRLEngine off CRLAgeCheck off CRLUpdateCritical off CRLHelper /usr/libexec/crlhelper Arguably the code should not be creating the semaphore if the CRLEngine is off.
(In reply to Martin Poole from comment #3) > Arguably the code should not be creating the semaphore if the CRLEngine is > off. Agreed. It seems a simple workaround is to remove the unused module.
To reproduce: - yum install mod_revocator (this will pull in all deps) - ipcs -s (confirm there are no apache semaphores) - service httpd start - service httpd stop - ipcs -s There will be 2 left-over semaphores. Remove them. For example: # ipcs -s ------ Semaphore Arrays -------- key semid owner perms nsems 0x00000000 17104896 apache 600 1 0x00000000 17235974 apache 600 1 # ipcrm -s 17104896 # ipcrm -s 17235974 # ipcs -s (confirm there are none) Install updated mod_nss and mod_revocator packages - service httpd start - service httpd stop - ipcs -s There should be no semaphores This is a baseline. You should also enable CRLEngine and configure a CRL and do additional testing to ensure that things are properly cleaned up a shutdown. Similarly some basic mod_nss testing using some SSL urls would be appropriate as well, particularly with a pin-protected NSS database. This change for mod_nss affects the pin storage helper.
Updated patch to fix segfault issue when shutting down.
Verified using mod_revocator version: mod_revocator-1.0.3-21.el7 Please find the attachment as verification steps. Marking BZ as verified.
Created attachment 1203239 [details] console.log
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2562.html