Re: [gentoo-hardened] SELinux and Apache - no pid file?

[Travis Fraser]

On Thu, 2005-10-06 at 22:00 -0400, Chris PeBenito wrote:
> On Thu, 2005-10-06 at 14:18 -0400, Albert Lash wrote:
> > The problem I am experiencing is when I restart apache. I do this as root,
> > su'd from a user with SELinux role staff_r and sysadm_r. I first login via
> > ssh as a normal user, then I newrole -r sysadm_r, then I su, and then I
> > /etc/init.d/apache2 restart. I get a warning that there is not pid. So
> > then I have to kill the process identified by ps -A, and then
> > /etc/init.d/apache start. (Whenever I run an init script, I have to
> > authenticate as the original user who has the sysadm_r role). The server
> > starts fine, but seems to have a delay before I can access the server via
> > a browser. Even when the server starts responding to browser requests, no
> > pid file is written to /var/run. There aren't even any denials in the
> > /var/log/messages files, which still wouldnt' prevent a pid file from
> > getting written, as I am in permissive mode.
>
It seems to have something to do with entropy?. See this thread:
http://forums.gentoo.org/viewtopic-t-384660-highlight-apache+pid.html

specifically this part:
MY_BUILTINS="--with-devrandom=/dev/urandom" emerge apache

This solved the exact problem for me even though I had no problems on
other servers (no selinux on any of them though).

> If this doesn't work in permissive, then it points to something not
> SELinux related being wrong.  I suggest looking at the apache logs for
> errors, and also check DAC perms.
>
> > I have also tried the SELinux run_init command before the ini script with
> > the same results.
>
> This won't help because Gentoo already has run_init integrated into the
> init script system.
>
> > Is this standard behavior for Apache2 on SELinux?
>
> No, I can't reproduce it on my enforcing systems.
>
-- 
Travis Fraser <travis@×××××××××.net>

-- 
gentoo-hardened@g.o mailing list