executing java from php in rhel/centos - not enough space for code cache

The apache user could run java programs just fine from the command line, but even the simplest java command in php would fail:

<?php
system('java -version');
?>

with the error 

Error occurred during initialization of VM
Could not reserve enough space for code cache. 

We already had the setsebool -P httpd_ssi_exec=1 option on, so that Apache had permission to execute whatever. Strangely, however, this "memory" issue is also due, somehow to selinux. Disabling selinux temporarily (e.g. with echo 0 >/selinux/enforce) or setting setsebool -P httpd_disable_trans=1 fixes the problem. I'd like less of a sledgehammer solution, but messing with other selinux settings does not seem to have any effect.


Edit: As a commenter below just indicated, you can use setsebool -P httpd_execmem=1 to disable this setting. If that doesn't work, well, back to the sledgehammer.

command-line mysql connection works, but not php

I was able to connect to a remote MySQL server from the command line on one of my servers, but that server, running php, was not able to make the connection, just returning a frustrating generic "cannot connect" message. The problem was of course selinux, and the solution:

# setsebool -P httpd_can_network_connect=1

Hat tip.

RHEL 5 - postfix suddenly can't send mail

As described in this RedHat bug, selinux-policy-2.4.6-255.el5_4.3 (1/7/2010) breaks postfix sendmail.

You'll see messages like:

fatal: username(1002): unable to execute /usr/sbin/postdrop -r: Success
postfix/sendmail[19202]: warning: premature end-of-input on /usr/sbin/postdrop -r while reading input attribute name

in /var/log/maillog.

You have a couple of options for dealing with this issue.

1. You can roll back to an earlier policy version and wait for a patched version to come out.
2. You can update the policy manually as described in the bug.
3. You can temporarily change selinux to permissive mode using "echo 0 > /selinux/enforce" until RHEL produces the patch. Then you can switch to enforcing again using "echo 1 > /selinux/enforce".

TIMTOWDI and all that, so perhaps you can think of others.