Re: [gentoo-hardened] SELinux and Apache - no pid file?

[Chris PeBenito]

On Thu, 2005-10-06 at 14:18 -0400, Albert Lash wrote:
> The problem I am experiencing is when I restart apache. I do this as root,
> su'd from a user with SELinux role staff_r and sysadm_r. I first login via
> ssh as a normal user, then I newrole -r sysadm_r, then I su, and then I
> /etc/init.d/apache2 restart. I get a warning that there is not pid. So
> then I have to kill the process identified by ps -A, and then
> /etc/init.d/apache start. (Whenever I run an init script, I have to
> authenticate as the original user who has the sysadm_r role). The server
> starts fine, but seems to have a delay before I can access the server via
> a browser. Even when the server starts responding to browser requests, no
> pid file is written to /var/run. There aren't even any denials in the
> /var/log/messages files, which still wouldnt' prevent a pid file from
> getting written, as I am in permissive mode.

If this doesn't work in permissive, then it points to something not
SELinux related being wrong.  I suggest looking at the apache logs for
errors, and also check DAC perms.

> I have also tried the SELinux run_init command before the ini script with
> the same results.

This won't help because Gentoo already has run_init integrated into the
init script system.

> Is this standard behavior for Apache2 on SELinux?

No, I can't reproduce it on my enforcing systems.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243