apache2 not starting on hardened

[turtles]

Moving to a from a gentoo server to a newer gentoo hardened server today.
Had apache2 running.
Had sql-ledger running (DBI Perl)

[turtles]

Well it has to do with:

[deface]

98)Address already in use: make_sock: could not bind to address 0.0.0.0:80 <-- you tried to restart too soon

E [21/Mar/2007:20:02:26 -0700] Unable to open listen socket for address :::631 - Address family not supported by protocol. <-- ipv6

apache2 & cups are 2 independent procs, neither interact with eachother. try looking at your /var/log/apache2/* logs, enable debug via
-D INFO in your apache2 opts at /etc/conf.d/apache2

[Hu]

Which kernel features are you using: SELinux, RSBAC, or GRSecurity? Are you trying to start Apache with the kernel's mandatory access control features enabled? If so, check that you have configured the ACL correctly for Apache. The error stating that it could not open logs suggests that either you have an incorrect path for logging or your ACL for Apache is denying it access to the logs it is supposed to write.

[turtles]

[Hu]

Those look like options from the GRsecurity patch. Is the system currently enforcing GRsecurity ACLs (enabled via gradm -E)? If I recall correctly, GRsecurity kernels tend to be somewhat chatty about ACL violations, signals, etc. Try to start Apache, then check your system logs to see if the kernel has printed any diagnostics about what Apache was doing. If that does not reveal anything, you could try emerging dev-util/strace and having it follow the Apache startup, but that will probably generate a large volume of data.

I doubt Apache would exceed your process limits during startup, unless you set them very low. I have an Apache running an almost-stock configuration, which only requires four processes when it is idle. If you are concerned about limits, run ulimit -a -S; ulimit -a -H and post the output. That will show the soft and hard limits that the shell is using.

Note that the ACL support you linked to is different from the ACL that may be in effect here. The ACLs discussed on the Wiki are an extended form of discretionary access control, which let you grant extra access beyond the standard user/group/other model. The ACL that may be in effect here is a form of mandatory access control, which is typically used to restrict access more than the standard model allows. For instance, you might want a rule that says that Apache is only allowed to exec programs in /var/www/localhost/cgi-bin and nowhere else. Such a rule would restrict the actions of a user who compromised Apache. Well-written MACLs typically follow the principle of least privilege: the subject described in the MACL is permitted to do only those things which are necessary for it to perform its duties, and nothing else. My concern is that Apache is being subjected to a MACL which grants it so little privilege that it cannot do some tasks it should do, such as write log files.

[turtles]

thanks for sticking with this Hu.

[chvo]

Well, the PAX error message is problably explained by the use of java:
http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml?style=printable#paxjava

use chpax to correct this (as explained on the FAQ page: you need to disable the necessary protections, since PaX will be upset by the code java generates).

[turtles]

Hey thanks.
Strange I wonder what is trying to use java?
Sql-ledger is written in Perl. Maybe cups?
_________________
Donate to Gentoo

[chvo]

[Hu]

[turtles]

[turtles]

A possible soloution to this is to use the -P flag with the lpr command that sql-ledger uses. I have switched back to regular Gentoo in the mean time and have not tested this.
_________________
Donate to Gentoo