krb5.conf不能被httpd进程读取

我有一个关于kerberos / httpd / RHEL的问题

系统1

这是有问题的系统。

OS: RHEL 6.6 Kernel: 2.6.32-431.29.2.el6.x86_64 CPU: Intel Xeon X5570

在服务器上运行一个kerberized网站。

系统2

这个系统使用相同的Kerberosconfiguration。

 OS: RHEL 6.5 Kernel: 2.6.32-431.23.3.el6.x86_64 CPU: Intel Xeon E5-2697

还运行一个kerberized网站。

问题

当用户访问网站时，以下消息显示在apache错误日志（LogLevel debug）中，用户将收到“Internal Server Error”（内部服务器错误）页面：

 [Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1944): [client 10.70.30.50] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1279): [client 10.70.30.50] Acquiring creds for HTTP/app-srv.domain.ch [Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1139): [client 10.70.30.50] GSS-API major_status:00020000, minor_status:000186a4 [Tue Aug 07 11:22:03 2015] [error] [client 10.70.30.50] gss_acquire_cred() failed: An invalid name was supplied (, )

通过更改/etc/krb5.conf的权限，可以在系统2上重现此错误，以便运行apache进程（apache）的用户无法读取该文件。

两个系统上的/etc/krb5.conf的权限都设置为root：root 644

我可以用sudo -u apache cat /etc/krb5.conf来获取文件。

debugging信息系统1

当用strace（ ps h --ppid $(sudo cat /var/run/httpd/httpd.pid) | awk '{print"-p " $1}' | xargs sudo strace -o /tmp/stracehttpd.log ）系统1将产生这些结果（只显示apachesubprocess访问/etc/krb5.conf的片段）：

 30216 fcntl(13, F_GETFD <unfinished ...> 30214 poll([{fd=14, events=POLLIN}], 1, 60000 <unfinished ...> 30216 <... fcntl resumed> ) = 0 30216 fcntl(13, F_SETFD, FD_CLOEXEC) = 0 30216 getsockname(13, {sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::ffff:10.70.30.50", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 30216 fcntl(13, F_GETFL) = 0x2 (flags O_RDWR) 30216 fcntl(13, F_SETFL, O_RDWR|O_NONBLOCK) = 0 30216 read(13, "GET /le HTTP/1.1\r\nHost: app-s"..., 8000) = 3519 30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 155) = 155 30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 134) = 134 30216 futex(0x7f04b63a00a0, FUTEX_WAKE_PRIVATE, 2147483647) = 0 30216 stat("/etc/gss/mech", 0x7ffff7f3d540) = -1 ENOENT (No such file or directory) 30216 stat("/etc/gss/mech", 0x7ffff7f3d490) = -1 ENOENT (No such file or directory) 30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied) 30216 stat("/etc/gss/mech", 0x7ffff7f3d350) = -1 ENOENT (No such file or directory) 30216 stat("/etc/gss/mech", 0x7ffff7f3d2a0) = -1 ENOENT (No such file or directory) 30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied) 30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied) 30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 137) = 137 30216 write(7, "[Tue Aug 11 14:47:03 2015] [erro"..., 118) = 118 30216 writev(13, [{"HTTP/1.1 500 Internal Server Err"..., 160}, {"<!DOCTYPE HTML PUBLIC \"-//IETF//"..., 625}], 2) = 785 30214 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}]) 30216 write(9, "10.70.30.50 - - [11/Aug/2015:14"..., 242) = 242 30214 read(14, <unfinished ...> 30216 shutdown(13, 1 /* send */) = 0 30214 <... read resumed> "HTTP/1.1 500 Internal Server Err"..., 8000) = 785 30216 poll([{fd=13, events=POLLIN}], 1, 2000 <unfinished ...>

debugging信息系统2

当用strace（ ps h --ppid $(sudo cat /var/run/httpd/httpd.pid) | awk '{print"-p " $1}' | xargs sudo strace -o /tmp/stracehttpd.log ）系统2将产生这些结果（只显示了apachesubprocess访问/etc/krb5.conf的片段）：

 6423 <... accept resumed> {sa_family=AF_INET6, sin6_port=htons(51438), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 13 6424 read(14, <unfinished ...> 6423 fcntl(13, F_GETFD <unfinished ...> 6424 <... read resumed> 0x7f1ad64e7198, 8000) = -1 EAGAIN (Resource temporarily unavailable) 6423 <... fcntl resumed> ) = 0 6424 poll([{fd=14, events=POLLIN}], 1, 60000 <unfinished ...> 6423 fcntl(13, F_SETFD, FD_CLOEXEC) = 0 6423 getsockname(13, {sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 6423 fcntl(13, F_GETFL) = 0x2 (flags O_RDWR) 6423 fcntl(13, F_SETFL, O_RDWR|O_NONBLOCK) = 0 6423 read(13, "GET /le HTTP/1.1\r\nHost: app-srv.dom"..., 8000) = 3082 6423 gettimeofday({1439292761, 106843}, NULL) = 0 6423 gettimeofday({1439292761, 107010}, NULL) = 0 6423 write(7, "[Tue Aug 11 13:32:41 2015] [debu"..., 146) = 146 6423 gettimeofday({1439292761, 107124}, NULL) = 0 6423 write(7, "[Tue Aug 11 13:32:41 2015] [debu"..., 115) = 115 6423 futex(0x7f1aca0ae308, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 futex(0x7f1aca0ae290, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 futex(0x7f1acaa090a0, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 stat("/etc/gss/mech", 0x7fff7298d2e0) = -1 ENOENT (No such file or directory) 6423 stat("/etc/gss/mech", 0x7fff7298d230) = -1 ENOENT (No such file or directory) 6423 futex(0x7f1aca7c52c0, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 futex(0x7f1aca7c5750, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 gettimeofday({1439292761, 107404}, NULL) = 0 6423 stat("/etc/krb5.conf", {st_mode=S_IFREG|0644, st_size=2294, ...}) = 0 6423 open("/etc/krb5.conf", O_RDONLY) = 14 6423 fcntl(14, F_SETFD, FD_CLOEXEC) = 0 6423 brk(0x7f1ad6504000) = 0x7f1ad6504000 6423 fstat(14, {st_mode=S_IFREG|0644, st_size=2294, ...}) = 0 6423 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1ad535d000 6423 read(14, "[logging]\n default = FILE:/var/l"..., 4096) = 2294 6423 read(14, "", 4096) = 0 6423 close(14) = 0 6423 munmap(0x7f1ad535d000, 4096) = 0 6423 gettimeofday({1439292761, 107642}, NULL) = 0 6423 gettimeofday({1439292761, 107663}, NULL) = 0 6423 open("/dev/urandom", O_RDONLY) = 14 6423 fcntl(14, F_SETFD, FD_CLOEXEC) = 0 6423 fstat(14, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0 6423 read(14, "bh\357\327\333\316\321\327\37\0\215[\37\331\213?o\34\272\246\303].\227\367p\23\225\356\352\272>"..., 64) = 64 6423 close(14) = 0 6423 open("/dev/urandom", O_RDONLY) = 14 6423 fcntl(14, F_SETFD, FD_CLOEXEC) = 0 6423 fstat(14, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0 6423 read(14, "N\301;|\377'\370\32\214u!%\234\25\21\365\10gi\227\362\273\321\373\324,\321\306*~\323\334"..., 64) = 64 6423 close(14) = 0 6423 futex(0x7f1aca4dd2c0, FUTEX_WAKE_PRIVATE, 2147483647) = 0 6423 gettimeofday({1439292761, 107952}, NULL) = 0

附加信息

kerberosconfiguration在两个系统上都是一样的。我也有成功运行相同Kerberosconfiguration的Ubuntu 12.04系统。除了拒绝访问/etc/krb5.conf到apache用户之外，我无法重现系统2上的错误。

检查selinux 。这看起来可能会干扰。

（这实际上是问题，正如在删除的评论中讨论）。