SELinux case
If the same sudo command is slow only in a daemon and fast on the command line, then it is caused by SELinux the most probably. (SELinux = NSA Security-Enhanced Linux kernel module, enabled in Fedora by default.)
A typical case is a http server and a special script for server management, restricted in sudoers
:
apache ALL=(root_or_user) NOPASSWD: /full/path/the_safe_command
It is typical in this case that nothing about SELinux is reported in the audit log ausearch -m avc -ts today
, but the script is going fast if we temporarily disable enforcing by setenforce 0
. (and then back enable by setenforce 1
)
The only relevant messages in the system log (journalcrl) are these after the delay 25 seconds:
... sudo[...] pam_systemd(sudo:session): Failed to create session: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
... sudo[...]: pam_unix(sudo:session): session opened for user root by (uid=0)
Logging of all silented "dont-audit" SElinux messages can be enabled by semodule -DB
and disabled again by semodule -B
.
(I hope that I write soon a SELinux policy module soon for this case here or a method from this answer can be used.)