Oracle Cloud上のOracle Linux 7インスタンスでyum check-updateを実行したところ、下記の様なメッセージが出力された。
[osakanataro@ocilinux ~]$ sudo yum check-update
読み込んだプラグイン:langpacks, ulninfo
Update notice ELBA-2021-9629 (ol7_developer から) is broken, or a bad duplicate, skipping.
You should report this problem to the owner of the ol7_developer repository.
To help pinpoint the issue, please attach the output of "yum updateinfo --verbose" to the report.
Update notice ELBA-2021-9631 (ol7_developer から) is broken, or a bad duplicate, skipping.
Security: kernel-uek-4.14.35-2047.510.5.2.el7uek.x86_64 is an installed security update
Security: kernel-uek-4.14.35-2047.504.2.el7uek.x86_64 is the currently running version
[osakanataro@ocilinux ~]$
とりあえず、出力にかいてある「yum updateinfo –verbose」を実行してみる。
[osakanataro@ocilinux ~]$ sudo yum updateinfo --verbose
無効になっているため、プラグイン「osmsplugin」は読み込みません
無効になっているため、プラグイン「rhnplugin」は読み込みません
プラグイン「ulninfo」を読み込んでいます
プラグイン「langpacks」を読み込んでいます
Adding en_US.UTF-8 to language list
Config time: 0.091
Yum version: 3.4.3
rpmdb time: 0.000
Setting up Package Sacks
pkgsack time: 0.255
Duplicate of ELBA-2021-9629 differs in some fields:
<<<<<<< ol7_developer:description
'[2.53.1-1]\n- Update to version 2.53.1\n\n[2.53.0-1]\n- Update to version 2.53.0\n\n[2.52.1-1]\n- Update to version 2.52.1\n\n[2.52.0-1]\n- Update to version 2.52.0\n\n[2.51.0-1]\n- Update to version 2.51.0\n\n[2.50.0-1]'
=======
'[2.53.1-1]\n- Update to version 2.53.1'
>>>>>>> ol7_addons:description
Update notice ELBA-2021-9629 (ol7_developer から) is broken, or a bad duplicate, skipping.
You should report this problem to the owner of the ol7_developer repository.
To help pinpoint the issue, please attach the output of "yum updateinfo --verbose" to the report.
Duplicate of ELBA-2021-9631 differs in some fields:
<<<<<<< ol7_developer:description
'[3.4.1-1]\n- Update to version 3.4.1\n\n[3.4.0-1]\n- Update to version 3.4.0\n\n[3.3.3-1]\n- Update to version 3.3.3\n\n[3.3.2-1]\n- Update to version 3.3.2\n\n[3.3.1-1]\n- Update to version 3.3.1\n\n[3.3.0-1]\n- Update to version 3.3.0\n\n[3.2.2-1]\n- Update to version 3.2.2\n\n[3.2.1-1]\n- Update to version 3.2.1\n\n[3.2.0-1]\n- Update to version 3.2.0\n\n[3.1.2-1]\n- Update to version 3.1.2\n\n[3.1.1-1]\n- Update to version 3.1.1\n\n[3.1.0-1]\n- Update to version 3.1.0\n\n[3.0.5-1]\n- Update to version 3.0.5\n\n[3.0.4-1]\n- Update to version 3.0.4\n\n[3.0.3-1]\n- Update to version 3.0.3\n\n[3.0.2-1]\n- Update to version 3.0.2\n\n[3.0.1-1]\n- Update to version 3.0.1\n\n[3.0.0-1]'
=======
'[3.4.1-1]\n- Update to version 3.4.1'
>>>>>>> ol7_addons:description
Update notice ELBA-2021-9631 (ol7_developer から) is broken, or a bad duplicate, skipping.
updateinfo time: 5.586
オブジェクトの更新を構築しています
up:Obs Init time: 4.605
up:simple updates time: 0.024
up:obs time: 0.008
up:condense time: 0.000
updates time: 10.097
Security: kernel-uek-4.14.35-2047.510.5.2.el7uek.x86_64 is an installed security update
Security: kernel-uek-4.14.35-2047.504.2.el7uek.x86_64 is the currently running version
updateinfo summary done
[osakanataro@ocilinux ~]$
# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
# info -f grub -n 'Simple configuration'
GRUB_DEFAULT=0
GRUB_TIMEOUT_STYLE=hidden
GRUB_TIMEOUT=0
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT="maybe-ubiquity"
GRUB_CMDLINE_LINUX=""
# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE=640x480
# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"
# Uncomment to get a beep at grub start
#GRUB_INIT_TUNE="480 440 1"
# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
# info -f grub -n 'Simple configuration'
GRUB_DEFAULT=0
GRUB_TIMEOUT_STYLE=menu
GRUB_TIMEOUT=10
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT="maybe-ubiquity nomodeset"
GRUB_CMDLINE_LINUX=""
# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE=640x480
GRUB_GFXMODE=800x600
GRUB_GFXPAYLOAD_LINUX=keep
# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"
# Uncomment to get a beep at grub start
#GRUB_INIT_TUNE="480 440 1"
書き換えたらgrub.cfgを生成するため「sudo update-grub2」を実行します。
instadmin@ubuntu:~$ sudo update-grub2
Sourcing file `/etc/default/grub'
Sourcing file `/etc/default/grub.d/init-select.cfg'
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-5.4.0-91-generic
Found initrd image: /boot/initrd.img-5.4.0-91-generic
done
instadmin@ubuntu:~$
[root@centos7 ~]# grub2-mkconfig -o /etc/grub2.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-3.10.0-1160.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-1160.el7.x86_64.img
Found linux image: /boot/vmlinuz-0-rescue-2c896cb2eafd4db586ecfbd67535d5dc
Found initrd image: /boot/initramfs-0-rescue-2c896cb2eafd4db586ecfbd67535d5dc.img
done
[root@centos7 ~]#
[root@retoge ~]# systemctl status php-fpm|cat
● php-fpm.service - The PHP FastCGI Process Manager
Loaded: loaded (/usr/lib/systemd/system/php-fpm.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Thu 2021-11-18 09:25:41 JST; 16s ago
Process: 482320 ExecStart=/usr/sbin/php-fpm --nodaemonize (code=exited, status=127)
Main PID: 482320 (code=exited, status=127)
Nov 18 09:25:41 retoge systemd[1]: Starting The PHP FastCGI Process Manager...
Nov 18 09:25:41 retoge php-fpm[482320]: /usr/sbin/php-fpm: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied
Nov 18 09:25:41 retoge systemd[1]: php-fpm.service: Main process exited, code=exited, status=127/n/a
Nov 18 09:25:41 retoge systemd[1]: php-fpm.service: Failed with result 'exit-code'.
Nov 18 09:25:41 retoge systemd[1]: Failed to start The PHP FastCGI Process Manager.
[root@retoge ~]#
[root@retoge ~]# getsebool httpd_execmem
httpd_execmem --> off
[root@retoge ~]# setsebool -P httpd_execmem on
[root@retoge ~]# getsebool httpd_execmem
httpd_execmem --> on
[root@retoge ~]#
[root@retoge ~]# systemctl start php-fpm
Job for php-fpm.service failed because the control process exited with error code.
See "systemctl status php-fpm.service" and "journalctl -xe" for details.
[root@retoge ~]# systemctl restart httpd
[root@retoge ~]# systemctl start php-fpm
Job for php-fpm.service failed because the control process exited with error code.
See "systemctl status php-fpm.service" and "journalctl -xe" for details.
[root@retoge ~]#
[root@retoge ~]# ausearch -m AVC |grep php| audit2allow
#============= httpd_t ==============
#!!!! This avc is allowed in the current policy
allow httpd_t http_port_t:tcp_socket name_connect;
allow httpd_t httpd_exec_t:file execmod;
#!!!! This avc can be allowed using the boolean 'httpd_unified'
allow httpd_t httpd_sys_content_t:dir write;
#!!!! This avc can be allowed using the boolean 'httpd_unified'
allow httpd_t httpd_sys_content_t:file write;
[root@retoge ~]#
これをモジュール化して組み込みます。
[root@retoge ~]# ausearch -m AVC |grep php| audit2allow -M php-fpm
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i php-fpm.pp
[root@retoge ~]# ls -l php-fpm*
-rw-r--r--. 1 root root 1594 Nov 18 09:51 php-fpm.pp
-rw-r--r--. 1 root root 597 Nov 18 09:51 php-fpm.te
[root@retoge ~]#
[root@retoge ~]# semodule -l |grep php
[root@retoge ~]# semodule -i php-fpm.pp
[root@retoge ~]# semodule -l |grep php
php-fpm
[root@retoge ~]#
php-fpmを起動してみます。
[root@retoge ~]# systemctl start php-fpm
[root@retoge ~]# systemctl status php-fpm
● php-fpm.service - The PHP FastCGI Process Manager
Loaded: loaded (/usr/lib/systemd/system/php-fpm.service; disabled; vendor preset: disabled)
Active: active (running) since Thu 2021-11-18 09:53:45 JST; 5s ago
Main PID: 489019 (php-fpm)
Status: "Ready to handle connections"
Tasks: 6 (limit: 36876)
Memory: 24.1M
CGroup: /system.slice/php-fpm.service
tq489019 php-fpm: master process (/etc/php-fpm.conf)
tq489020 php-fpm: pool www
tq489021 php-fpm: pool www
tq489022 php-fpm: pool www
tq489023 php-fpm: pool www
mq489024 php-fpm: pool www
Nov 18 09:53:45 retoge systemd[1]: Starting The PHP FastCGI Process Manager...
Nov 18 09:53:45 retoge systemd[1]: Started The PHP FastCGI Process Manager.
[root@retoge ~]#
