Hide Forgot
SELinux is preventing /usr/sbin/lighttpd from using the 'sys_resource' capabilities. ***** Plugin sys_resource (53.1 confidence) suggests *********************** If you do not want to get this AVC any longer. These AVC's are caused by running out of resources, usually disk space on your / partition. Then you must cleanup diskspace or make sure you are not running too many processes. Do clear up your disk. ***** Plugin catchall_boolean (42.6 confidence) suggests ******************* If you want to allow httpd daemon to change system limits Then you must tell SELinux about this by enabling the 'httpd_setrlimit' boolean. Do setsebool -P httpd_setrlimit 1 ***** Plugin catchall (5.76 confidence) suggests *************************** If you believe that lighttpd should have the sys_resource capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep lighttpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:system_r:httpd_t:s0 Target Objects Unknown [ capability ] Source lighttpd Source Path /usr/sbin/lighttpd Port <Unknown> Host (removed) Source RPM Packages lighttpd-1.4.26-4.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.16-16.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux localhost 2.6.38.3-18.fc15.x86_64 #1 SMP Fri Apr 22 13:24:23 UTC 2011 x86_64 x86_64 Alert Count 2 First Seen Thu 28 Apr 2011 08:24:48 PM MSD Last Seen Thu 28 Apr 2011 08:29:44 PM MSD Local ID dab534d9-c1a9-443a-8253-d81e79c9d1d5 Raw Audit Messages type=AVC msg=audit(1304008184.45:1521): avc: denied { sys_resource } for pid=31515 comm="lighttpd" capability=24 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=capability type=SYSCALL msg=audit(1304008184.45:1521): arch=x86_64 syscall=setrlimit success=no exit=EPERM a0=7 a1=7fff0fd27470 a2=1000 a3=7fff0fd26e20 items=0 ppid=31514 pid=31515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=lighttpd exe=/usr/sbin/lighttpd subj=system_u:system_r:httpd_t:s0 key=(null) Hash: lighttpd,httpd_t,httpd_t,capability,sys_resource audit2allow #============= httpd_t ============== #!!!! This avc can be allowed using the boolean 'httpd_setrlimit' allow httpd_t self:capability sys_resource; audit2allow -R #============= httpd_t ============== #!!!! This avc can be allowed using the boolean 'httpd_setrlimit' allow httpd_t self:capability sys_resource;
1. $ sudo service start lighttpd 2. result: audit alert as present above 3. Resume: lighttpd not started. All active konsole session provided with message: 130 admin ~ $ Broadcast message from root@localhost (Thu, 28 Apr 2011 20:31:45 +0400): Password entry required for 'Please enter passphrase for disk WDC_WD7500BPVT (luks-9cx11317-8f37-19d3-7c09-5cc2dc129172)!' (PID 31507). Please enter password with the systemd-tty-ask-password-agent tool! Broadcast message from root@localhost (Thu, 28 Apr 2011 20:41:27 +0400): Password entry required for 'Please enter passphrase for disk WDC_WD7500BPVT (luks-9cx11317-8f37-19d3-7c09-5cc2dc129172)!' (PID 32258). Please enter password with the systemd-tty-ask-password-agent tool!
The real status of hdd 'WDC_WD7500BPVT' (/dev/sdb): already decrypted and mounted ~9 hour ago
dmesg | tail [27422.925366] bridge-virbr0: disabling the bridge [27422.933229] bridge-virbr0: down [27422.933238] bridge-virbr0: detached [27422.933301] /dev/vmnet: open called by PID 1499 (vmnet-bridge) [27422.933319] /dev/vmnet: hub 0 does not exist, allocating memory. [27422.933376] /dev/vmnet: port on hub 0 successfully opened [27422.933388] bridge-em1: up [27422.933391] bridge-em1: attached [27433.383449] em1: no IPv6 routers present [33719.022472] systemd-tty-ask[32297]: segfault at 0 ip 0000003bd9f2654f sp 00007fffdab71248 error 4 in libc-2.13.90.so[3bd9e00000+192000]
lighttpd logs: empty sudo ls -laZ /var/log/lighttpd/ total 8 drwxr-x---. 2 system_u:object_r:httpd_log_t:s0 www-data www-data 4096 Mar 23 21:36 . drwxr-xr-x. 32 system_u:object_r:var_log_t:s0 root root 4096 Apr 28 20:21 ..
Additional Selinux alert: https://bugzilla.redhat.com/show_bug.cgi?id=700568
If you restart another service, does it work without the same issue?
Did you turn on the boolean suggested in the alert?
(In reply to comment #6) > If you restart another service, does it work without the same issue? Sure: same issue during service tor restart
(In reply to comment #7) > Did you turn on the boolean suggested in the alert? Suggested 'turn on': rejected (no changed)
What does getsebool httpd_setrlimit output? If I run your AVC's through audit2allow I see audit2allow -i /tmp/t #============= httpd_t ============== #!!!! This avc can be allowed using the boolean 'httpd_setrlimit' allow httpd_t self:capability sys_resource; Are you seeing other AVC's?
(In reply to comment #10) > What does > > getsebool httpd_setrlimit > > output? > > > If I run your AVC's through audit2allow I see > > audit2allow -i /tmp/t > > > #============= httpd_t ============== > #!!!! This avc can be allowed using the boolean 'httpd_setrlimit' > > allow httpd_t self:capability sys_resource; > > Are you seeing other AVC's? allowing httpd_setrlimit disappear AVC alert: admin ~ » getsebool httpd_setrlimit httpd_setrlimit --> on lighttpd still not started: s service lighttpd start [sudo] password for admin: Starting lighttpd (via systemctl): Job failed. See system logs and 'systemctl status' for details. [FAILED] 1 admin ~ » 130 admin ~ » systemctl status Too few arguments. 1 admin ~ » admin ~ » s tail -100 /var/log/audit/audit.log | grep lighttpd type=SERVICE_START msg=audit(1304098567.788:225): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="lighttpd" exe="/bin/systemd" hostname=? addr=? terminal=? res=failed' admin ~ »
That is not an error in the audit log. Does it work in permissive mode?
(In reply to comment #12) > That is not an error in the audit log. Does it work in permissive mode? admin ~ » s sh -c 'echo 0 > /selinux/enforce' [sudo] password for admin: admin ~ » s service lighttpd start Starting lighttpd (via systemctl): Job failed. See system logs and 'systemctl status' for details.
So it looks like it is not an SELinux issue at this point. BTW, use "setenforce 0" /selinux might be moving in F16 to /sys/fs/selinux.
Going back to enforce: admin ~ » s sh -c 'echo 1 > /selinux/enforce' [sudo] password for admin: admin ~ » Resume: 1. Isssie with selinux alert like 'Please enter password with the systemd-tty-ask-password-agent tool!' disappeared after 'sudo yum -y --skip-broken update' 2. Issue with lighttpd affected to: 'lighttpd.conf' => 'server.pid-file' variable: server.pid-file = /var/run/lighttpd.pid or: server.pid-file = /run/lighttpd.pid" After commenting 'server.pid-file' variables 'lighttpd.conf' like: # server.pid-file = /var/run/lighttpd.pid # server.pid-file = /run/lighttpd.pid" So: sudo service lighttps start => OK