Re: [gentoo-hardened] SELinux and Apache - no pid file?

[Albert Lash]

Way to go Travis thank you for the link and advice, this fixed my issue!
As a follow up, the compilation gave me a warning about lazy bindings, and
suggested I compile with these additional options:

 CFLAGS="-Wl,-z,now"

I did so and it compiled OK.

Cheers!

Albert

On Thu, 6 Oct 2005, Travis Fraser wrote:

> On Thu, 2005-10-06 at 22:00 -0400, Chris PeBenito wrote:
> > On Thu, 2005-10-06 at 14:18 -0400, Albert Lash wrote:
> > > The problem I am experiencing is when I restart apache. I do this as root,
> > > su'd from a user with SELinux role staff_r and sysadm_r. I first login via
> > > ssh as a normal user, then I newrole -r sysadm_r, then I su, and then I
> > > /etc/init.d/apache2 restart. I get a warning that there is not pid. So
> > > then I have to kill the process identified by ps -A, and then
> > > /etc/init.d/apache start. (Whenever I run an init script, I have to
> > > authenticate as the original user who has the sysadm_r role). The server
> > > starts fine, but seems to have a delay before I can access the server via
> > > a browser. Even when the server starts responding to browser requests, no
> > > pid file is written to /var/run. There aren't even any denials in the
> > > /var/log/messages files, which still wouldnt' prevent a pid file from
> > > getting written, as I am in permissive mode.
> >
> It seems to have something to do with entropy?. See this thread:
> http://forums.gentoo.org/viewtopic-t-384660-highlight-apache+pid.html
>
> specifically this part:
> MY_BUILTINS="--with-devrandom=/dev/urandom" emerge apache
>
> This solved the exact problem for me even though I had no problems on
> other servers (no selinux on any of them though).
>
> > If this doesn't work in permissive, then it points to something not
> > SELinux related being wrong.  I suggest looking at the apache logs for
> > errors, and also check DAC perms.
> >
> > > I have also tried the SELinux run_init command before the ini script with
> > > the same results.
> >
> > This won't help because Gentoo already has run_init integrated into the
> > init script system.
> >
> > > Is this standard behavior for Apache2 on SELinux?
> >
> > No, I can't reproduce it on my enforcing systems.
> >
> --
> Travis Fraser <travis@×××××××××.net>
>
> --
> gentoo-hardened@g.o mailing list
>
-- 
gentoo-hardened@g.o mailing list