Red Hat Bugzilla – Bug 492608
SELinux is preventing httpd startup via 'su -c' only
Last modified: 2009-04-11 19:41:02 EDT
Created attachment 337040 [details]
Text file exported from setroubleshoot.
Description of problem: httpd starts normally if I'm already root, but 'su -c service httpd start' fails.
Version-Release number of selected component (if applicable):
Policy 23, httpd-2.2.11-2.fc10.i386
Allways. 3 tests.
Steps to Reproduce:
1. Start/stop httpd as root.
2. Start/stop via 'su -c service httpd start'
SELinux is preventing httpd (httpd_t) "read write" unconfined_t.
Normal httpd start.
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 23
Policy from config file: targeted
Are you using kde? It is leaking open file descriptors.
Yes I am, updated just before I found this issue. Well, except for sepostgresql, which I had to remove because it couldn't coexist with postgresql-server after the update. That's Bug 485510.
A file descriptor leak sounded like a good candidate as this machine is always on, and I'm a heavy konsole user. I rebooted, and repeated the test. Same result. I haven't tweaked /proc/sys/fs/file-max. It's 101836, as installed, and "grep 'descriptors' /var/log/messages" turns up nothing.
ls /proc/$(pidof konsole)/fdinfo | wc -l
which seems a large number (35 sockets, 9 pipes), but I don't know what it should look like. All contexts are unconfined_u:unconfined_r:unconfined_t:s0.
That's historical information, for others searching around in here. Continuing in that vein, 'file descriptor' was the piece of info I lacked. Searching around on KDE, I find https://bugs.kde.org/show_bug.cgi?id=180785 and
https://bugs.kde.org/show_bug.cgi?id=183917 which was closed as a dupe, but contains half a dozen links back into the RH Bugzilla. Including:
and your comment #4, which pretty much explains it.
*** This bug has been marked as a duplicate of bug 484370 ***