Bug 817824 - Internal Server Error if /tmp directory and credential ccache have incorrect permissions
Internal Server Error if /tmp directory and credential ccache have incorrect ...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: mod_auth_kerb (Show other bugs)
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Web Stack Team
BaseOS QE - Apps
Depends On:
  Show dependency treegraph
Reported: 2012-05-01 09:28 EDT by Jenny Galipeau
Modified: 2017-10-17 03:37 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2017-10-17 03:37:52 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jenny Galipeau 2012-05-01 09:28:56 EDT
Description of problem:

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@TESTRELM.COM

Valid starting     Expires            Service principal
05/01/12 09:21:32  05/02/12 09:21:31  krbtgt/TESTRELM.COM@TESTRELM.COM
05/01/12 09:21:34  05/02/12 09:21:31  HTTP/dhcp-186-52.testrelm.com@TESTRELM.COM

# ls -al /tmp/krb5cc_0 
-rw-------. 1 root root 1229 May  1 09:21 /tmp/krb5cc_0

# ipa user-find
ipa: ERROR: cannot connect to u'http://dhcp-186-52.testrelm.com/ipa/xml': Internal Server Error

[Tue May 01 09:22:07 2012] [error] [client] gss_acquire_cred() failed: Unspecified GSS failure.  Minor code may provide more information (, ), referer: https://dhcp-186-52.testrelm.com/ipa/xml

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. delete /tmp/
2. mkdir -p /tmp/
3. chmod 1777 /tmp/
4. kinit admin
5. ipa user-find
Actual results:
ipa: ERROR: cannot connect to u'http://dhcp-186-52.testrelm.com/ipa/xml': Internal Server Error

Expected results:
Error specifying what the problem is.

Additional info:
Comment 1 Rob Crittenden 2012-05-01 09:39:10 EDT
Were there any AVCs related to this?

Can you provide more context in the error log? Perhaps retry it with LogLevel set to debug in /etc/httpd/conf.d/nss.conf (restart httpd required)?

The Internal Server Error is designed to be generic and provide as little information as possible. It is expected that the user will report this to an administrator who will investigate further.

This should most likely be re-assigned to krb5 which is generating the unspecified GSS failure. Perhaps it can better report on permission problems.
Comment 2 Jenny Galipeau 2012-05-01 10:26:27 EDT
Yup ::

# cat /var/log/audit/audit.log | grep AVC
type=AVC msg=audit(1335882337.598:41120): avc:  denied  { write } for  pid=1594 comm="httpd" name="tmp" dev=dm-0 ino=521231 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
Comment 3 Dmitri Pal 2012-05-01 11:42:18 EDT
Moving to krb5. Please open an upstream bug.
The bug should talk about making Kerberos error messages more informative.
Comment 4 Rob Crittenden 2012-05-01 17:38:41 EDT
Created krbdev.mit.edu issue #7123
Comment 5 RHEL Product and Program Management 2012-05-05 00:14:53 EDT
Since RHEL 6.3 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 6 Robbie Harwood 2015-09-09 18:07:44 EDT
Upstream thinks this is a problem with the capture of error messages, not with krb5 itself; they believe that more information is available though IPA (through mod_auth_kerb) is not printing it.
Comment 8 Red Hat Bugzilla Rules Engine 2017-10-17 03:37:52 EDT
Development Management has reviewed and declined this request. You may appeal this decision by reopening this request.

Note You need to log in before you can comment on or make changes to this bug.