Paul's Blog Entries for July 2006

Saturday 1st July 2006

Fedora Extras

Monday 3rd July 2006

Local Packages

Tuesday 4th July 2006

Local Packages

Wiki

Fedora Extras

Wednesday 5th July 2006

Happy birthday mum!

Local Packages

Fedora QA

Thursday 6th July 2006

Fedora QA

Fedora Extras

Made a start at putting together the remaining bits of the Gnome-1 stack that have gone from Core in Fedora Core 6. I need everything up to linglade (needed for php-gtk, which is needed for pptpconfig), so I made packages of ORBit and libpng10 ready for submission to Extras.

Friday 7th July 2006

Local Packages

Fedora QA

Monday 10th July 2006

Local Packages

Fedora Extras

Tuesday 11th July 2006

SELinux Policy Update

Got a message from cron this morning: 

/etc/cron.daily/yum.cron:

libsepol.scope_copy_callback: proftpd: Duplicate declaration in module: type/attribute ftpdctl_exec_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!

The reason for this was that my proftpd policy module is now included in the upstream and Fedora base policy, and the definition of the ftpdctl_exec_t type in the new base policy conflicts with the same definition in my local policy module. The solution is of course to unload my local policy module as it's no longer needed: 

# semodule -r proftpd

However, that still left me with the old base policy loaded (since linking the new one with my local modules had failed at rpm upgrade time), so I also needed: 

# semodule -b /usr/share/selinux/targeted/base.pp

This got me fully up to date.

Wednesday 12th July 2006

Local Packages

Fedora Extras

Dining Out

Went for a nice meal from work at the Bay Tree Restaurant in Cheadle with our colleagues from LSI Logic.

Web Server Outage

Made a tweak to the web server configuration but it failed to restart. The error log said: 

[Wed Jul 12 18:52:49 2006] [notice] mod_python: Creating 4 session mutexes based on 256 max processes and 0 max threads.
[Wed Jul 12 18:52:50 2006] [emerg] (28)No space left on device: Couldn't create accept lock (/etc/httpd/logs/accept.lock.7109) (5)

I had no full partitions, nor were there any SELinux issues, which I thought were the most likely reasons for this problem. Fortunately google came to the rescue, with a search on the error message turning up http://www.webpipe.net/howto/Apache_accept_lock_fix. The output of ipcs -s with httpd stopped was a big, long list, all owned by apache. So the fix was to kill them all: 

for semid in `ipcs -s | grep apache | cut -f2 -d" "`; do ipcrm -s $semid; done

After doing this, httpd started up without issues.

Thursday 13th July 2006

Local Packages

Friday 14th July 2006

Fedora QA

Monday 17th July 2006

Local Packages

Fedora Extras

Wiki

Thursday 20th July 2006

Fedora Extras

5-a-side

Friday 21st July 2006

Fedora Extras

Local Packages

Saturday 22nd July 2006

Leon

Took Leon to the playground in Woodheys Park for the first time.

leon-swing.jpg

leon-round.jpg

leon-climb.jpg

Monday 24th July 2006

Hospital Visit

Local Packages

Tuesday 25th July 2006

Local Packages

Fedora QA

Crash Recovery

My firewall/web server box crashed mysteriously for the second time in two weeks. Still haven't figured out what's going on with that. Anyway, some issues cropped up during the reboot.

Firstly, the ldap service didn't start because the Berkeley DB backend was in a broken state and needed recovering: 

# slapd_db_recover -v -h /var/lib/ldap
Finding last valid log LSN: file: 1 offset 4530737
Recovery starting from [1][2795526]
Recovery complete at Tue Jul 25 18:49:15 2006
Maximum transaction ID 8000054d Recovery checkpoint [1][4532387]
# service ldap start
Checking configuration files for slapd:  bdb_db_open: unclean shutdown detected; attempting recovery.
bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered.
config file testing succeeded
                                                           [  OK  ]
Starting slapd:                                            [  OK  ]

I also found a useful page on the openldap BDB backend, and I decided to add a checkpoint directive to slapd.conf: 

database        bdb

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap

# check point whenever 128k data bytes written or
# 15 minutes has elapsed whichever occurs first
checkpoint 128 15

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index displayName                       eq,pres,sub
index marker                            eq,pres,sub

Next up, the /var/spool/bacula fileystem where I have my bacula storage daemon write backups to before I write them DVD didn't get nounted at reboot. This was an SELinux issue: 

type=AVC msg=audit(1153848704.795:345): avc:  denied  { mounton } for  pid=1829 comm="mount" name="bacula" dev=dm-4 ino=1146906 scontext=system_u:system_r:mount_t:s0 tcontext=user_u:object_r:var_spool_t:s0 tclass=dir
type=SYSCALL msg=audit(1153848704.795:345): arch=40000003 syscall=21 success=no exit=-13 a0=98a70b8 a1=98a70d0 a2=98a3058 a3=c0ed0001 items=1 pid=1829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0
type=AVC_PATH msg=audit(1153848704.795:345):  path="/var/spool/bacula"
type=CWD msg=audit(1153848704.795:345):  cwd="/"
type=PATH msg=audit(1153848704.795:345): item=0 name="/var/spool/bacula" inode=1146906 dev=fd:04 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=user_u:object_r:var_spool_t:s0

The problem was that the /var/spool/bacula directory on the root filesystem (i.e. the mount point) had the default file context type for that location of mount_t, and the initscripts weren't allowed to mount anything there (though mounting it manually works fine of course, since that is an unconfined operation). The fix is simple: 

# chcon -t mnt_t /var/spool/bacula
# service netfs restart
Mounting other filesystems:                                [  OK  ]
# df /var/spool/bacula
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/mapper/VgExtra-Bacula
                      46445552  30978788  13107532  71% /var/spool/bacula

There were more SELinux denials but I didn't have time to look at them today.

Wednesday 26th July 2006

Local Packages

Fedora QA

Thursday 27th July 2006

Fedora QA

Local Packages

Friday 28th July 2006

Local Packages

Fedora Extras

Saturday 29th July 2006

Local Packages

Monday 31st July 2006

Local Packages

Fedora Extras

Fedora QA

Previous Month: June 2006
Next Month: August 2006