| Summary: | SELinux prevent cobbler import | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jens Kleineheismann <redhat> | ||||||
| Component: | selinux-policy-targeted | Assignee: | Lukas Vrabec <lvrabec> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 19 | CC: | dwalsh, redhat | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | selinux-policy-3.12.1-74.8.fc19 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2013-09-30 00:35:32 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Attachments: |
|
||||||||
Could you please to re-test it in permissive mode or you can run # semanage permissive -a cobblerd_t re-test # ausearch -m avc -ts recent Thank you. Created attachment 798662 [details]
Output of ausearch -m avc -ts recent
With permissive mode for cobblerd the task succeed. Please see 798662 attachment for ausearch output. Greetings, Jens 3422057ec411c299c8b59df75d2fafa4015748a7 fixes this in git. back ported. selinux-policy-3.12.1-74.8.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.8.fc19 Package selinux-policy-3.12.1-74.8.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.8.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17739/selinux-policy-3.12.1-74.8.fc19 then log in and leave karma (feedback). selinux-policy-3.12.1-74.8.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 796299 [details] Snippet of the audit.log Description of problem: cobbler import fail while causing an AVC. Since the inoperable cobbler import command is shown in the Fedora Installation Guide, Chapter 13 'Setting Up an Installation Server' I will assign HIGH severity. Version-Release number of selected component (if applicable): - Fedora 19 - selinux-policy-3.12.1-74.1 - cobbler-2.4.0-1 - rsync-3.0.9-8 How reproducible: everytime Steps to Reproduce: # getenforce Enforcing # mkdir /mnt/dvd # mount -o loop Fedora-19-x86_64-DVD.iso /mnt/dvd # cobbler import --name=f19 --path=/mnt/dvd Actual results: ----- 8< ----- task started: 2013-09-11_103319_import task started (id=Media import, time=Wed Sep 11 10:33:19 2013) Exception occured: <class 'cobbler.cexceptions.CX'> Exception value: 'Command failed' Exception Info: File "/usr/lib/python2.7/site-packages/cobbler/remote.py", line 89, in run rc = self._run(self) File "/usr/lib/python2.7/site-packages/cobbler/remote.py", line 232, in runner self.logger File "/usr/lib/python2.7/site-packages/cobbler/api.py", line 879, in import_tree utils.run_this(rsync_cmd, (spacer, mirror_url, path), self.logger) File "/usr/lib/python2.7/site-packages/cobbler/utils.py", line 920, in run_this die(logger,"Command failed") File "/usr/lib/python2.7/site-packages/cobbler/utils.py", line 137, in die raise CX(msg) !!! TASK FAILED !!! ----- >8 ----- auditd logs an AVC: ----- 8< ----- type=AVC msg=audit(1378888400.788:534): avc: denied { getattr } for pid=21988 comm="sh" path="/usr/bin/rsync" dev="dm-0" ino=400408 scontext=system_u:system_r:cobblerd_t:s0 tcontext=system_u:object_r:rsync_exec_t:s0 tclass=file ----- >8 ----- in /var/log/cobbler/cobbler.log you will find: ----- 8< ----- Wed Sep 11 10:33:19 2013 - DEBUG | REMOTE CLI Authorized; user(?) Wed Sep 11 10:33:19 2013 - INFO | REMOTE start_task(Media import); event_id(2013-09-11_103319_import); user(?) Wed Sep 11 10:33:20 2013 - INFO | import_tree; ['/mnt/dvd', 'f19', None, None, None] Wed Sep 11 10:33:20 2013 - INFO | importing from a network location, running rsync to fetch the files first Wed Sep 11 10:33:20 2013 - INFO | running: rsync -a '/mnt/dvd/' /var/www/cobbler/ks_mirror/f19 --progress Wed Sep 11 10:33:20 2013 - INFO | received on stdout: Wed Sep 11 10:33:20 2013 - DEBUG | received on stderr: /bin/sh: rsync: command not found Wed Sep 11 10:33:20 2013 - INFO | Exception occured: <class 'cobbler.cexceptions.CX'> Wed Sep 11 10:33:20 2013 - INFO | Exception value: 'Command failed' Wed Sep 11 10:33:20 2013 - INFO | Exception Info: File "/usr/lib/python2.7/site-packages/cobbler/utils.py", line 129, in die raise CX(msg) ----- >8 ----- Expected results: cobbler should not fail. I expect it to mirror the content of /mnt/dvd to /var/www/cobbler/ks_mirror/f19 via rsync at least. Additional info: # getsebool -a | grep -E '(cobbler|rsync)' cobbler_anon_write --> off cobbler_can_network_connect --> off cobbler_use_cifs --> off cobbler_use_nfs --> off httpd_can_network_connect_cobbler --> off httpd_serve_cobbler_files --> off postgresql_can_rsync --> off rsync_anon_write --> off rsync_client --> off rsync_export_all_ro --> off rsync_full_access --> off # ls -dZ /mnt/dvd drwxrwsr-x. root 101737 system_u:object_r:iso9660_t:s0 /mnt/dvd/ # ls -dZ /var/www/cobbler/ks_mirror drwxr-xr-x. root root system_u:object_r:cobbler_var_lib_t:s0 /var/www/cobbler/ks_mirror/