Discuss June 2014

discuss@lists.centos.org

122 participants
120 discussions

Re: [CentOS] SELinux context for web application directories
by m.roth＠5-cent.us 30 Jun '14

30 Jun '14

Not sure if this got through - nixspam was being aggravating, so I'm reposting. James B. Byrne wrote: > CentOS-6.5 > We deploy web applications written with the Ruby on Rails framework using Capistrano (2.x). Each 'family' of web applications are 'owned' by a dedicated user id. The present httpd service is Apache 2.2.15 and we use Passenger 3.0.11. We are moving shortly to a new deployment host and at that > time we will be updating to Apache 2.4.9 and Passenger 4..0.25. > Our deployment practice is to place the 'family' directory under /var/data/. > This is the home directory of the application user id. We place each individual web application or component into its own directory underneath the > family root. So that things look like this: passenger_exec_t, etc. <http://linuxmanpages.net/manpages/fedora17/man8/passenger_selinux.8.html> And if you google anything else, note: DO NOT USE CHCON; it does *NOT* remain following a reboot. Use semanage fcontext (and the manpage example is what I use all the time), followed by a restorecon -Rv mark

1 0

Re: [CentOS] SELinux context for web application directories
by James B. Byrne 30 Jun '14

30 Jun '14

On Sun, June 29, 2014 06:59, Daniel J Walsh wrote: > > On 06/27/2014 11:47 AM, James B. Byrne wrote: >> CentOS-6.5 >> >> The questions I have are: What is an appropriate SELinux context for such a >> directory structure given it is used by a httpd service? Is the default >> user >> home setting of system_u:object_r:home_root_t acceptable? Is >> system_u:object_r:httpd_sys_content_t preferable instead? is some other >> SELinux context preferred for RoR web applications using Apache with >> mod-passenger? >> >> > I would think that httpd_sys_content_t and httpd_sys_rw_content_t would > be appropriate. > These are not real user accounts, meaning normal users do not login to > these systems. Does it matter that the application user has to login so that the capistrano deply receipes will run correctly? Also this deploy makes use of rbenv which is another user login dependent item (requires a shim in .bash_profile). Does that have any impact on the choice? Finally, and only peripherally related, what are the SELinux settings, boolean or profile, required on CentOS-6.5 to get Apache mod-passenger to run without generating avc's? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

3D Acceleration with Matrox MGA G200EH?
by Dave Johansen 30 Jun '14

30 Jun '14

I'm running on a machine with a Matrox MGA G200EH but it doesn't appear that the 3D acceleration is being used (for example Google Earth lists the driver as being Mesa). Is there an additional driver that I need to install to enable the 3D acceleration functionality? Or something else I need to do? Thanks, Dave

1 0

iostat results for multi path disks
by David Goldsmith 30 Jun '14

30 Jun '14

Here is a sample of running iostat on a server that has a LUN from a SAN with multiple paths. I am specifying a device list that just grabs the bits related to the multi path device: $ iostat -dxkt 1 2 sdf sdg sdh sdi dm-7 dm-8 dm-9 Linux 2.6.18-371.8.1.el5 (db21b.den.sans.org) 06/20/2014 Time: 02:30:23 PM Device: rrqm/s wrqm/s r/s w/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util sdf 0.66 52.32 3.57 34.54 188.38 347.52 28.13 0.14 3.62 0.87 3.31 sdg 0.66 52.29 3.57 34.56 189.79 347.48 28.18 0.14 3.72 0.87 3.32 sdh 0.00 0.00 0.00 0.00 0.00 0.00 14.19 0.00 2.90 2.90 0.00 sdi 0.00 0.00 0.00 0.00 0.00 0.00 14.19 0.00 2.87 2.87 0.00 dm-7 0.00 0.00 8.46 173.75 378.17 695.00 11.78 3.41 18.68 0.35 6.46 dm-8 0.00 0.00 8.46 173.75 378.17 695.00 11.78 3.41 18.68 0.36 6.47 dm-9 0.00 0.00 8.46 173.75 378.17 695.00 11.78 3.41 18.68 0.36 6.48 Time: 02:30:24 PM Device: rrqm/s wrqm/s r/s w/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util sdf 0.00 54.00 7.00 48.00 88.00 408.00 18.04 0.12 2.11 1.20 6.60 sdg 0.00 13.00 1.00 26.00 4.00 156.00 11.85 0.01 0.52 0.48 1.30 sdh 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 sdi 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 dm-7 0.00 0.00 8.00 141.00 92.00 564.00 8.81 0.25 1.69 0.53 7.90 dm-8 0.00 0.00 8.00 141.00 92.00 564.00 8.81 0.25 1.70 0.54 8.00 dm-9 0.00 0.00 8.00 141.00 92.00 564.00 8.81 0.25 1.70 0.54 8.00 sdf,sdg,sdh,sdi - four paths for LUN (sdf and sdg are the active paths) dm-7 - device-mapper pseudo device for the mpath device dm-8 - device-mapper pseudo-device for the partition spanning the entire mpath device dm-9 - device-mapper pseudo-device for the LVM LV created on the mpath device The first sample from iostat is the historical data so lets ignore it. The second sample are the stats for a 1 second interval. I see the stats for sdf and sdg are roughly equal but they differ — they are the two active paths that are both being used. I see the stats for dm-7, dm-8 and dm-9 are almost completely identical - makes sense as they really represent the same “disk”. What confuses me is the fact that all the stats for sdf/sdg don’t add up to be equivalent to the dm-[789] devices For the rkB/s and wkB/s columns, the numbers for sdf and sdg add up to equal the numbers for dm-9. But for the first four columns: Column sdf/sdg dm-9 ====== ============= ==== rrqm/s 0.0 + 0.0 = 0.0 0 wrqm/s 54.0 +13.0 = 67.0 0 Very different r/s 7.0 + 1.0 = 8.0 8.0 w/s 48.0 + 26.0 = 74.0 141.0 Very different So read data matches and write data diverges Which numbers should I go with? The physical devices or the logical device? Thanks David Goldsmith

2 1

Re: [CentOS] Firewall question
by Jerry Geis 30 Jun '14

30 Jun '14

Actually I think I was wrong... Somehow the mail is landing on my box (from an address I am not blocking) and this particular email is requesting going OUT of my box. Seems the firewall operating fine. I just looked at it incorrectly. Jerry

2 1

Re: [CentOS] [CentOS-devel] [OT, partly]epel question (Mate problem)
by Fred Smith 29 Jun '14

29 Jun '14

On Sat, Jun 21, 2014 at 05:38:35PM -0400, Fred Smith wrote: > On Fri, Jun 20, 2014 at 09:30:09PM -0500, Jim Perrin wrote: > > > > > > On 06/20/2014 08:37 PM, Fred Smith wrote: > > > I've installed MATE desktop (and related packages) from epel on my C7 VM, > > > just to see how it works on C7. > > > > > > The answer I've got is "not too well", but I fear I may have done something > > > wrong. > > > > > > Before I go any further, is it not toally unreasonable to ask this here? or > > > should I be banished to redhat bugzilla? > > > > It's not really a 'centos-development' type question, so it's not really > > on topic here. It would be more appropriate on the general mailing list. > > It's something I'm reasonably close to though, so if you'd ask your > > questions there, I'd be happy to try to help. > > thanks Jim. You mean the Centos list, or epel list? > > > > > > > > > I've got it to the point where when I log in I get top and bottom panels, > > > and desktop wallpaper. But nothing is drawn in front of the wallpaper, > > > and right-click context menu on the desktop doesn't do anything. Everything > > > that I can access thru a panel icon, a panel menu, or a terminal seems > > > to be working. > > > > It was built in epel-devel against the beta I believe, which has a bit > > of turn-over from the rc and the final code we're building against for > > the open qa builds. It may be that it simply needs to cycle through the > > build system again. > > > > > > > > I did log on epel IRC and talked with "wolfy" about it, but he didn't have > > > any firm answers (several good suggestions, though). > > > > > > > If you can ask on the main mailing list, I'll try to help as best I can. > > Worst case, it will give me something to point out to the MATE > > maintainer for epel that won't vanish like irc logs. OK, here on the general Centos list, I have one more thing to add to the above: I was chatting on the epel list about it, didn't get a lot of help (no reflection on those there) but smooge said he might have time to look into it next week. Also, someone else from the centos list sent private email that he had had the same problem and thought it might be a caja problem, but had not gone any further than that. So, I opened a terminal and started caja. Voila! not only did a caja window open, but the desktop icons appeared, and the right-click menu. however when I closed the terminal it all went away. :( so I did ALT-F2 and typed in "caja", hit enter, and there's the full desktop again. and this time it stayed. from these symptoms I don't think I can tell if it's a caja problem, or an issue with whoever starts up caja after login (something in systemd ???) > > Jim Perrin > > The CentOS Project | http://www.centos.org > > twitter: @BitIntegrity | GPG Key: FA09AD77 -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ---------------------------- Do you not know? Have you not heard? The LORD is the everlasting God, the Creator of the ends of the earth. He will not grow tired or weary, and his understanding no one can fathom. ----------------------------- Isaiah 40:28 (niv) -----------------------------

2 3

SELinux context for web application directories
by James B. Byrne 29 Jun '14

29 Jun '14

CentOS-6.5 We deploy web applications written with the Ruby on Rails framework using Capistrano (2.x). Each 'family' of web applications are 'owned' by a dedicated user id. The present httpd service is Apache 2.2.15 and we use Passenger 3.0.11. We are moving shortly to a new deployment host and at that time we will be updating to Apache 2.4.9 and Passenger 4..0.25. Our deployment practice is to place the 'family' directory under /var/data/. This is the home directory of the application user id. We place each individual web application or component into its own directory underneath the family root. So that things look like this: /var/data/hll_th ├── backups │ └── pgsql ├── etc │ └── database.yml ├── hll_th_cc_edi_get │ ├── current -> /var/data/hll_th/hll_th_forex_rss/releases/20140519201615 │ ├── releases │ └── shared ├── hll_th_forex_rss │ ├── current -> /var/data/hll_th/hll_th_forex_rss/releases/20131204193652 │ ├── releases │ └── shared ├── hll_th_hp3000_billing │ ├── current -> /var/data/hll_th/hll_th_forex_rss/releases/20140214211431 │ ├── releases │ └── shared ├── log ├── lost+found └── pgpass -> .pgpass The questions I have are: What is an appropriate SELinux context for such a directory structure given it is used by a httpd service? Is the default user home setting of system_u:object_r:home_root_t acceptable? Is system_u:object_r:httpd_sys_content_t preferable instead? is some other SELinux context preferred for RoR web applications using Apache with mod-passenger? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Admin business
by m.roth＠5-cent.us 29 Jun '14

29 Jun '14

Karanbir, PLEASE! You've never responded to my question about whitelisting. That asinine nixspam did it to me again, and this time... seriously, I urge you, personally, to go there and try to remove a site. They've "enhanced their security", that is, mangling the capchas, to the point that it took me about five minutes or more, and about a dozen or 15 challenges, before I got one that I could read well enough to copy into the "I'm human" field. This is *really* impossible now. Oh, and the audio challenge is a very bad joke. *YOU* try to figure out what it says.... mark, frustrated

3 2

CentOS-announce Digest, Vol 112, Issue 13
by centos-announce-request＠centos.org 28 Jun '14

28 Jun '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2014:0795 CentOS 6 rsh FASTTRACK Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Jun 2014 18:48:43 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0795 CentOS 6 rsh FASTTRACK Update To: centos-announce(a)centos.org Message-ID: <20140627184843.GA49115(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0795 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0795.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 79b6656b7f36ffec0058ad435db81cfb9e99f94ba52c81fcbbf2fa5e36268e8f rsh-0.17-64.el6.i686.rpm 1cbf8996a61f0c9d4400f5c13db2aa23991a364aa0bc47bfb96de32749b7d134 rsh-server-0.17-64.el6.i686.rpm x86_64: bdd693d083e38e4e3db4678228ab804e0e337f4337621e20707d1680102babd6 rsh-0.17-64.el6.x86_64.rpm d0deb1948040f466207133798fe824d6898c0a29c3bab14bb823f74db441a4a8 rsh-server-0.17-64.el6.x86_64.rpm Source: 59f8a9711c98ba02f2577b8066a6a7adaba07d6e0bf111d4104d10a326486616 rsh-0.17-64.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 112, Issue 13 ************************************************

1 0

Re: [CentOS] SELinux context for web application directories
by m.roth＠5-cent.us 27 Jun '14

27 Jun '14

James B. Byrne wrote: > CentOS-6.5 > We deploy web applications written with the Ruby on Rails framework using Capistrano (2.x). Each 'family' of web applications are 'owned' by a dedicated user id. The present httpd service is Apache 2.2.15 and we use Passenger 3.0.11. We are moving shortly to a new deployment host and at that > time we will be updating to Apache 2.4.9 and Passenger 4..0.25. > Our deployment practice is to place the 'family' directory under /var/data/. > This is the home directory of the application user id. We place each individual web application or component into its own directory underneath the > family root. So that things look like this: passenger_exec_t, etc. <http://linuxmanpages.net/manpages/fedora17/man8/passenger_selinux.8.html> And if you google anything else, note: DO NOT USE CHCON; it does *NOT* remain following a reboot. Use semanage fcontext (and the manpage example is what I use all the time), followed by a restorecon -Rv mark

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2014