Bug 492608 - SELinux is preventing httpd startup via 'su -c' only
Summary: SELinux is preventing httpd startup via 'su -c' only
Keywords:
Status: CLOSED DUPLICATE of bug 484370
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 10
Hardware: i386
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-03-27 17:14 UTC by Greg Metcalfe
Modified: 2009-04-11 23:41 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-03-27 23:45:06 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Text file exported from setroubleshoot. (5.28 KB, text/plain)
2009-03-27 17:14 UTC, Greg Metcalfe
no flags Details

Description Greg Metcalfe 2009-03-27 17:14:10 UTC
Created attachment 337040 [details]
Text file exported from setroubleshoot.

Description of problem: httpd starts normally if I'm already root, but 'su -c service httpd start' fails.


Version-Release number of selected component (if applicable):
Policy 23, httpd-2.2.11-2.fc10.i386

How reproducible:
Allways. 3 tests.

Steps to Reproduce:
1. Start/stop httpd as root.
2. Start/stop via 'su -c service httpd start'
3.
  
Actual results:
SELinux is preventing httpd (httpd_t) "read write" unconfined_t.

Expected results:
Normal httpd start.

Additional info:
$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 23
Policy from config file:        targeted

Comment 1 Daniel Walsh 2009-03-27 19:14:14 UTC
Are you using kde?  It is leaking open file descriptors.

Comment 2 Greg Metcalfe 2009-03-27 21:51:40 UTC
Yes I am, updated just before I found this issue. Well, except for sepostgresql, which I had to remove because it couldn't coexist with postgresql-server after the update. That's Bug 485510.
kdebase-4.2.1-2.fc10.i386
kdelibs-4.2.1-4.fc10.i386

Comment 3 Greg Metcalfe 2009-03-27 23:45:06 UTC
A file descriptor leak sounded like a good candidate as this machine is always on, and I'm a heavy konsole user. I rebooted, and repeated the test. Same result. I haven't tweaked /proc/sys/fs/file-max. It's 101836, as installed, and "grep 'descriptors' /var/log/messages" turns up nothing.
ls /proc/$(pidof konsole)/fdinfo | wc -l
49
which seems a large number (35 sockets, 9 pipes), but I don't know what it should look like. All contexts are unconfined_u:unconfined_r:unconfined_t:s0.

That's historical information, for others searching around in here. Continuing in that vein, 'file descriptor' was the piece of info I lacked. Searching around on KDE, I find https://bugs.kde.org/show_bug.cgi?id=180785 and
https://bugs.kde.org/show_bug.cgi?id=183917 which was closed as a dupe, but contains half a dozen links back into the RH Bugzilla. Including:
https://bugzilla.redhat.com/show_bug.cgi?id=480569
and your comment #4, which pretty much explains it.

Thanks, Greg

Comment 4 Kevin Kofler 2009-04-11 23:41:02 UTC

*** This bug has been marked as a duplicate of bug 484370 ***


Note You need to log in before you can comment on or make changes to this bug.