On Wed, 2023-09-06 at 10:15 -0700, Samuel Sieb wrote:
On 2023-09-06 03:38, Patrick O'Callaghan wrote:
> The swap stuff works (as discussed in an earlier thread), but the
> Apache restart fails:
>
> Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start
> } for auid=n/a uid=0 gid=0
> path="/usr/lib/systemd/system/httpd.service" cmdline=""
> function="bus_unit_method_start_>
> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart
> httpd.service: Access denied
> Sep 06 08:01:33 Bree systemctl[201281]: See system logs and
> 'systemctl status httpd.service' for details.
> Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main
> process exited, code=exited, status=4/NOPERMISSION
>
> However once the system is up and resumed, I can restart it
> manually
> with no issues. This looks like an SElinux problem, so what's the
> solution?
I'm interested in a solution for that as well. Certbot has the same
problem when running from cron.
Not a solution per se, but a workaround. Instead of restarting Apache
from the service file, I touch a file in /run and keep a small script
checking it every minute (executed from crontab). That seems to work,
but it's a kludge and shouldn't be necessary. I've tried looking into
the proper security context to eliminate the AVC errors, but it's a
real rabbit-hole and I can't be bothered, though there are plenty of
people who seem to report similar problems.
I also reported to BZ the basic problem of Apache not resuming itself
without all this faffing around, but have had no response so far:
https://bugzilla.redhat.com/show_bug.cgi?id=2238297
poc