Bug 492608 - SELinux is preventing httpd startup via 'su -c' only
SELinux is preventing httpd startup via 'su -c' only
Status: CLOSED DUPLICATE of bug 484370
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
i386 Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2009-03-27 13:14 EDT by Greg Metcalfe
Modified: 2009-04-11 19:41 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-03-27 19:45:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Text file exported from setroubleshoot. (5.28 KB, text/plain)
2009-03-27 13:14 EDT, Greg Metcalfe
no flags Details

  None (edit)
Description Greg Metcalfe 2009-03-27 13:14:10 EDT
Created attachment 337040 [details]
Text file exported from setroubleshoot.

Description of problem: httpd starts normally if I'm already root, but 'su -c service httpd start' fails.

Version-Release number of selected component (if applicable):
Policy 23, httpd-2.2.11-2.fc10.i386

How reproducible:
Allways. 3 tests.

Steps to Reproduce:
1. Start/stop httpd as root.
2. Start/stop via 'su -c service httpd start'
Actual results:
SELinux is preventing httpd (httpd_t) "read write" unconfined_t.

Expected results:
Normal httpd start.

Additional info:
$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 23
Policy from config file:        targeted
Comment 1 Daniel Walsh 2009-03-27 15:14:14 EDT
Are you using kde?  It is leaking open file descriptors.
Comment 2 Greg Metcalfe 2009-03-27 17:51:40 EDT
Yes I am, updated just before I found this issue. Well, except for sepostgresql, which I had to remove because it couldn't coexist with postgresql-server after the update. That's Bug 485510.
Comment 3 Greg Metcalfe 2009-03-27 19:45:06 EDT
A file descriptor leak sounded like a good candidate as this machine is always on, and I'm a heavy konsole user. I rebooted, and repeated the test. Same result. I haven't tweaked /proc/sys/fs/file-max. It's 101836, as installed, and "grep 'descriptors' /var/log/messages" turns up nothing.
ls /proc/$(pidof konsole)/fdinfo | wc -l
which seems a large number (35 sockets, 9 pipes), but I don't know what it should look like. All contexts are unconfined_u:unconfined_r:unconfined_t:s0.

That's historical information, for others searching around in here. Continuing in that vein, 'file descriptor' was the piece of info I lacked. Searching around on KDE, I find https://bugs.kde.org/show_bug.cgi?id=180785 and
https://bugs.kde.org/show_bug.cgi?id=183917 which was closed as a dupe, but contains half a dozen links back into the RH Bugzilla. Including:
and your comment #4, which pretty much explains it.

Thanks, Greg
Comment 4 Kevin Kofler 2009-04-11 19:41:02 EDT

*** This bug has been marked as a duplicate of bug 484370 ***

Note You need to log in before you can comment on or make changes to this bug.