[gentoo-hardened] SELinux and Apache - no pid file?

[Albert Lash]

Hi all,

I'm running an SELinux base system (followed the AMD64 howto for changing
a normal Gentoo system to a SELinux Gentoo system) with Apache2.

I keep the files accessed by Apache in a different directory than those
prescribed by the file contexts, so I added some regexp filters to
properly label my files, which seems to have worked, and I can access the
files via Apache without getting denials in /var/log/messages. (I am
running permissive mode right now).

The problem I am experiencing is when I restart apache. I do this as root,
su'd from a user with SELinux role staff_r and sysadm_r. I first login via
ssh as a normal user, then I newrole -r sysadm_r, then I su, and then I
/etc/init.d/apache2 restart. I get a warning that there is not pid. So
then I have to kill the process identified by ps -A, and then
/etc/init.d/apache start. (Whenever I run an init script, I have to
authenticate as the original user who has the sysadm_r role). The server
starts fine, but seems to have a delay before I can access the server via
a browser. Even when the server starts responding to browser requests, no
pid file is written to /var/run. There aren't even any denials in the
/var/log/messages files, which still wouldnt' prevent a pid file from
getting written, as I am in permissive mode.

I have also tried the SELinux run_init command before the ini script with
the same results.

Is this standard behavior for Apache2 on SELinux? I doubt it since I am
running another non-SELinux server which creates the apache.pid file
every time. Any recommendations on how to get Apache starting,
restarting, and stopping properly?

Thank you!

Albert
-- 
gentoo-hardened@g.o mailing list