On Tue, 2011-06-28 at 19:13 -0700, James McKenzie wrote:
On 6/28/11 6:37 PM, Genes MailLists wrote:
> On 06/28/2011 08:17 PM, Daniel J Walsh wrote:
>>> Does this work as regular user for you? For me - selinux makes it
crash.
>> run ausearch -m avc -ts recent
>>
>> And see if it generates any output.
>>
>> SELinux error messages are written to /var/log/audit/audit.log
>>
>>
>>
> Thanks Dan - Nope no selinux logs on this one best I can tell. If I
> run as user I get:
>
> $ needs-restarting
> Traceback (most recent call last):
> File "/usr/bin/needs-restarting", line 137, in<module>
> sys.exit(main(sys.argv))
> File "/usr/bin/needs-restarting", line 117, in main
> for fn in get_open_files(pid):
> File "/usr/bin/needs-restarting", line 84, in get_open_files
> for line in maps.readlines():
> IOError: [Errno 13] Permission denied
>
>
> Its odd - line 117 in needs-restarting is this fragment:
>
>
> for pid in return_running_pids(uid=myuid):
> try:
> pid_start = os.stat('/proc/' + pid)[stat.ST_CTIME]
> except OSError, e:
> continue
> found_match = False
> for fn in get_open_files(pid):
>
> Works fine as root.
Usually ordinary users are prohibited from accessing /proc/<whatever>
from what I remember. That is why root works and joe-blow does not.
James McKenzie
In fact most of the contents of /proc/<pid> are world-readable. Try 'ls
-l /proc/<some-pid>'. Specifically, the smaps file is world-readable,
which is what needs-restarting uses to get the names of open files. It
essentially builds a table from the internal equivalent of "grep
fd: /proc/*/smaps".
I invariably run needs-restarting under my own user id just after
updating, and I have never seen the above traceback.
poc