Bug 153501

Summary: Problem with the apache IMPORTANT I NEED HELP!
Product: [openSUSE] SUSE LINUX 10.0 Reporter: Pedro Zenon <pzenon>
Component: AppArmorAssignee: Dominic W Reynolds <dreynolds>
Status: RESOLVED WONTFIX QA Contact: Dominic W Reynolds <dreynolds>
Severity: Critical    
Priority: P5 - None    
Version: unspecified   
Target Milestone: ---   
Hardware: i386   
OS: SuSE Linux 10.0   
Whiteboard:
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Pedro Zenon 2006-02-24 22:07:48 UTC 
i have an webbase application running on SuSE Linux 10.0 since september. Last week the application doesn't work. I checked the apache error log and it gave me an erro like this 

[error] Failed to change_hat to 'HANDLING_UNTRUSTED_INPUT'
child pid 6611 exit signal File size limit exceeded (25)

I need to fix it as soon as possible


Pleaase help me
Comment 1 Dominic W Reynolds 2006-02-24 23:10:35 UTC 
Hi,

The first error is indicating that the apache module mod-change-hat has been loaded by apache but the apache profile does not contain a definition for this "hat" or subprofile.

You can generate this by:

a) Using the profile tools to generate updated policy that contains the requested hat:

1. Setting apache to complain mode: [complain /usr/sbin/httpd2-prefork]
2. Letting your application run
3. Running logprof and answering the questions to generate new profile entries
    The questions will prompt you to create new sub profiles (aka hats) the hat 
    mentioned in this error message should be created automatically.

b) Disable the mod_change_hat module. 
 
1. Execute rpm -e mod_change_hat
2. Execute /etc/init.d/apache2 restart


c) Disable AppArmor

1. Execute /etc/init.d/boot.subdomain stop


This may not fix your file size limit problem - it isn't obviously related to an AppArmor policy rejection. Is it possible for you to submit an attachement of your /var/log/messages file (gzipped) or the results of "grep REJECT /var/log/messages"? This would help isolate a specific AppArmor rejection that may be related to you problem.
Comment 2 Dominic W Reynolds 2007-01-29 18:33:57 UTC 
Were you able to resolve this issue?
Comment 3 Dominic W Reynolds 2007-02-02 22:03:47 UTC 
 no info provided. closing. can reopen if we see this again. seth how relevant is this issue to the recent apparmor-dev discussion about a similar failure?
Comment 4 Seth R Arnold 2007-02-02 22:42:34 UTC 
Slight possibility; but the signal behaviour was different from what Christian saw. Impossible to say without further details.