On Wed, 2023-09-06 at 10:15 -0700, Samuel Sieb wrote:
> On 2023-09-06 03:38, Patrick O'Callaghan wrote:
> > The swap stuff works (as discussed in an earlier thread), but the
> > Apache restart fails:
> >
> > Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start
> > } for auid=n/a uid=0 gid=0
> > path="/usr/lib/systemd/system/httpd.service" cmdline=""
> > function="bus_unit_method_start_>
> > Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart
> > httpd.service: Access denied
> > Sep 06 08:01:33 Bree systemctl[201281]: See system logs and
> > 'systemctl status httpd.service' for details.
> > Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main
> > process exited, code=exited, status=4/NOPERMISSION
> >
> > However once the system is up and resumed, I can restart it
> > manually
> > with no issues. This looks like an SElinux problem, so what's the
> > solution?
>
> I'm interested in a solution for that as well. Certbot has the same
> problem when running from cron.
Not a solution per se, but a workaround. Instead of restarting Apache
from the service file, I touch a file in /run and keep a small script
checking it every minute (executed from crontab). That seems to work,
but it's a kludge and shouldn't be necessary. I've tried looking into
the proper security context to eliminate the AVC errors, but it's a
real rabbit-hole and I can't be bothered, though there are plenty of
people who seem to report similar problems.
I also reported to BZ the basic problem of Apache not resuming itself
without all this faffing around, but have had no response so far:
https://bugzilla.redhat.com/show_bug.cgi?id=2238297
poc
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
