Red Hat Bugzilla – Bug 492608
SELinux is preventing httpd startup via 'su -c' only
Last modified: 2009-04-11 19:41:02 EDT
Created attachment 337040 [details] Text file exported from setroubleshoot. Description of problem: httpd starts normally if I'm already root, but 'su -c service httpd start' fails. Version-Release number of selected component (if applicable): Policy 23, httpd-2.2.11-2.fc10.i386 How reproducible: Allways. 3 tests. Steps to Reproduce: 1. Start/stop httpd as root. 2. Start/stop via 'su -c service httpd start' 3. Actual results: SELinux is preventing httpd (httpd_t) "read write" unconfined_t. Expected results: Normal httpd start. Additional info: $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 23 Policy from config file: targeted
Are you using kde? It is leaking open file descriptors.
Yes I am, updated just before I found this issue. Well, except for sepostgresql, which I had to remove because it couldn't coexist with postgresql-server after the update. That's Bug 485510. kdebase-4.2.1-2.fc10.i386 kdelibs-4.2.1-4.fc10.i386
A file descriptor leak sounded like a good candidate as this machine is always on, and I'm a heavy konsole user. I rebooted, and repeated the test. Same result. I haven't tweaked /proc/sys/fs/file-max. It's 101836, as installed, and "grep 'descriptors' /var/log/messages" turns up nothing. ls /proc/$(pidof konsole)/fdinfo | wc -l 49 which seems a large number (35 sockets, 9 pipes), but I don't know what it should look like. All contexts are unconfined_u:unconfined_r:unconfined_t:s0. That's historical information, for others searching around in here. Continuing in that vein, 'file descriptor' was the piece of info I lacked. Searching around on KDE, I find https://bugs.kde.org/show_bug.cgi?id=180785 and https://bugs.kde.org/show_bug.cgi?id=183917 which was closed as a dupe, but contains half a dozen links back into the RH Bugzilla. Including: https://bugzilla.redhat.com/show_bug.cgi?id=480569 and your comment #4, which pretty much explains it. Thanks, Greg
*** This bug has been marked as a duplicate of bug 484370 ***