Description of problem:
Using mod_auth_kerb (or mod_auth_pam) to authenticate users with kerberos
creates some problem in httpd.  The kerberos libraries use "nss" for SSL.  The
nss SSL libraries call "netstat -ni" to initialize their entropy, and usually do
not collect its exit status properly.  I believe that this is a bug in the
safe_pclose() function in mozilla/security/nss/lib/freebl/unix_rand.c in nss,
but I've only observed the problem in apache so far.

Using strace, I see this:

The httpd process executes "netstat -ni", which runs as normal and calls
exit_group(0).  httpd does not get SIGCHLD immediately, but does get EOF on the
output of netstat.  It then enters a loop, alternately trying to kill the
netstat process and reap its status with waitpid.  Most of the time, it will not
get SIGCHLD until later, usually when it calls select() on an unrelated
operation.  Apparently apache has no handler for SIGCHLD, and the netstat
process remains in a defunct state.

Version-Release number of selected component (if applicable):
httpd-2.2.3-7.el5
krb5-libs-1.5-29
nss-3.11.5-3.

How reproducible:
Most of the time.  When apache is configured for kerberos authentication, most
requests will leave behind one or more defunct netstat processes.