I've noticed recently that Apache often (or perhaps always) doesn't respond after a system hibernate/resume cycle. After restarting it ('apachectl restart') all is well.
I could script an automatic restart after resuming, but I wondered if this is a well-known problem with a simpler solution.
poc
On Fri, 2023-09-01 at 12:36 +0100, Patrick O'Callaghan wrote:
I've noticed recently that Apache often (or perhaps always) doesn't respond after a system hibernate/resume cycle. After restarting it ('apachectl restart') all is well.
I could script an automatic restart after resuming, but I wondered if this is a well-known problem with a simpler solution.
No replies so far, so I attempted the automatic restart, using this script:
# cat hibernate-resume.service [Unit] Description=Disable swap after resuming from hibernation After=hibernate.target
[Service] SyslogIdentifier=%N User=root Type=oneshot ExecStart=/bin/bash -c ' \ /usr/sbin/swapoff /SWAP/swapfile ; \ /usr/sbin/apachectl graceful ; \ '
[Install]
The swap stuff works (as discussed in an earlier thread), but the Apache restart fails:
Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/httpd.service" cmdline="" function="bus_unit_method_start_> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart httpd.service: Access denied Sep 06 08:01:33 Bree systemctl[201281]: See system logs and 'systemctl status httpd.service' for details. Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main process exited, code=exited, status=4/NOPERMISSION
However once the system is up and resumed, I can restart it manually with no issues. This looks like an SElinux problem, so what's the solution?
poc
On 2023-09-06 03:38, Patrick O'Callaghan wrote:
The swap stuff works (as discussed in an earlier thread), but the Apache restart fails:
Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/httpd.service" cmdline="" function="bus_unit_method_start_> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart httpd.service: Access denied Sep 06 08:01:33 Bree systemctl[201281]: See system logs and 'systemctl status httpd.service' for details. Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main process exited, code=exited, status=4/NOPERMISSIONHowever once the system is up and resumed, I can restart it manually with no issues. This looks like an SElinux problem, so what's the solution?
I'm interested in a solution for that as well. Certbot has the same problem when running from cron.
On 6 Sep 2023, at 11:38, Patrick O'Callaghan pocallaghan@gmail.com wrote:
ExecStart=/bin/bash -c ' \ /usr/sbin/swapoff /SWAP/swapfile ; \ /usr/sbin/apachectl graceful ; \ '
You can avoid the need for bash in this case by using ExecStartPre
ExecStartPre=/usr/sbin/swapoff /SWAP/swapfile ExecStart=/usr/sbin/apachectl graceful
Barry
On Wed, 2023-09-06 at 19:09 +0100, Barry wrote:
On 6 Sep 2023, at 11:38, Patrick O'Callaghan pocallaghan@gmail.com wrote:
ExecStart=/bin/bash -c ' \ /usr/sbin/swapoff /SWAP/swapfile ; \ /usr/sbin/apachectl graceful ; \ '
You can avoid the need for bash in this case by using ExecStartPre
ExecStartPre=/usr/sbin/swapoff /SWAP/swapfile ExecStart=/usr/sbin/apachectl graceful
Thanks, but I'm not sure how this addresses the SElinux problem.
poc
On Wed, 2023-09-06 at 10:15 -0700, Samuel Sieb wrote:
On 2023-09-06 03:38, Patrick O'Callaghan wrote:
The swap stuff works (as discussed in an earlier thread), but the Apache restart fails:
Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/httpd.service" cmdline="" function="bus_unit_method_start_> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart httpd.service: Access denied Sep 06 08:01:33 Bree systemctl[201281]: See system logs and 'systemctl status httpd.service' for details. Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main process exited, code=exited, status=4/NOPERMISSION However once the system is up and resumed, I can restart it manually with no issues. This looks like an SElinux problem, so what's the solution?
I'm interested in a solution for that as well. Certbot has the same problem when running from cron.
I guess I could use setenforce off/on around the bash command, but it's crude and might leave a security hole.
poc
On 6 Sep 2023, at 21:57, Patrick O'Callaghan pocallaghan@gmail.com wrote:
Thanks, but I'm not sure how this addresses the SElinux problem.
I am just showing that you do not need to use bash to run more then one command in a systemd service unit.
Barry
On Thu, 2023-09-07 at 08:40 +0100, Barry wrote:
On 6 Sep 2023, at 21:57, Patrick O'Callaghan pocallaghan@gmail.com wrote:
Thanks, but I'm not sure how this addresses the SElinux problem.
I am just showing that you do not need to use bash to run more then one command in a systemd service unit.
Yes, I get that, and thanks again.
poc
On Wed, 2023-09-06 at 10:15 -0700, Samuel Sieb wrote:
On 2023-09-06 03:38, Patrick O'Callaghan wrote:
The swap stuff works (as discussed in an earlier thread), but the Apache restart fails:
Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/httpd.service" cmdline="" function="bus_unit_method_start_> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart httpd.service: Access denied Sep 06 08:01:33 Bree systemctl[201281]: See system logs and 'systemctl status httpd.service' for details. Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main process exited, code=exited, status=4/NOPERMISSION However once the system is up and resumed, I can restart it manually with no issues. This looks like an SElinux problem, so what's the solution?
I'm interested in a solution for that as well. Certbot has the same problem when running from cron.
Not a solution per se, but a workaround. Instead of restarting Apache from the service file, I touch a file in /run and keep a small script checking it every minute (executed from crontab). That seems to work, but it's a kludge and shouldn't be necessary. I've tried looking into the proper security context to eliminate the AVC errors, but it's a real rabbit-hole and I can't be bothered, though there are plenty of people who seem to report similar problems.
I also reported to BZ the basic problem of Apache not resuming itself without all this faffing around, but have had no response so far:
https://bugzilla.redhat.com/show_bug.cgi?id=2238297
poc
On Fri, 2023-09-01 at 12:36 +0100, Patrick O'Callaghan wrote:
I've noticed recently that Apache often (or perhaps always) doesn't respond after a system hibernate/resume cycle. After restarting it ('apachectl restart') all is well.
I could script an automatic restart after resuming, but I wondered if this is a well-known problem with a simpler solution.
Just wondering if simply having a delayed restart would work? Perhaps something else isn't ready in time.
A wait for a network? The general unhibernate/resume triggering a restart after a little while?
On Thu, 2023-09-14 at 03:03 +0930, Tim via users wrote:
On Fri, 2023-09-01 at 12:36 +0100, Patrick O'Callaghan wrote:
I've noticed recently that Apache often (or perhaps always) doesn't respond after a system hibernate/resume cycle. After restarting it ('apachectl restart') all is well.
I could script an automatic restart after resuming, but I wondered if this is a well-known problem with a simpler solution.
Just wondering if simply having a delayed restart would work? Perhaps something else isn't ready in time.
A wait for a network? The general unhibernate/resume triggering a restart after a little while?
It's definitely an AVC error, and as far as I can see from the journal the network is already up. In any case, a delayed start would be as fussy to arrange as my work-around, and no more elegant.
poc
On Wed, 2023-09-06 at 10:15 -0700, Samuel Sieb wrote:
On 2023-09-06 03:38, Patrick O'Callaghan wrote:
The swap stuff works (as discussed in an earlier thread), but the Apache restart fails:
Sep 06 08:01:33 Bree systemd[1]: selinux: avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/httpd.service" cmdline="" function="bus_unit_method_start_> Sep 06 08:01:33 Bree systemctl[201281]: Failed to restart httpd.service: Access denied Sep 06 08:01:33 Bree systemctl[201281]: See system logs and 'systemctl status httpd.service' for details. Sep 06 08:01:33 Bree systemd[1]: hibernate-resume.service: Main process exited, code=exited, status=4/NOPERMISSIONHowever once the system is up and resumed, I can restart it manually with no issues. This looks like an SElinux problem, so what's the solution?
I'm interested in a solution for that as well. Certbot has the same problem when running from cron.
Just a heads-up that a year has gone by and nothing has changed. I still get the AVC error and have no idea how to fix it.
poc
-
Barry -
Patrick O'Callaghan -
Samuel Sieb -
Tim