Bug 1042864

One more please:

semanage fcontext -a -t httpd_sys_content_t '/var/log/mirrormanager/crawler(/.*)?'

(or I could move the crawler logs to somewhere besides /var/log I suppose, such as under /var/lib/mirrormanager/crawler/* if that would be preferred).

I would leave the logs files there. although I am not crazy about labeling them as apache content.  Since log file tools would be broken, like logrotate.

The best solution would be add policy for mirrormanager and allow httpd_t to read mirrormanager_log_t and mirrormanager_var_lib_t.

Miroslav I added mirrormanager policy to git.

4e392a73ea87b8f14ddbba5944a759a712c99622

We should add this to RHEL and make mirrormanager_t an unconfined_domain.

Matt how does mirrormanager run?  Is is started by init?

Dan - there are several components to mirrormanager, that run under different contexts I suppose.

There is the mirrormanager web app, which is a python WSGI app run under apache, which is run by init.  This needs to read the crawler logs.

There is the crawler, which is run under cron, which write the crawler logs.

Ok well first things we need is the labels on mirrormanager content and then give access to those.

Matt do you have any AVC's you could attach?

Created attachment 837385 [details]
audit.logs

Logs attached.  Here are a few that I recognize:

httpd reading /var/lib/mirrormanager/mirrorlists/ (the publiclist HTML pages which are created by a cronjob.

httpd reading /var/log/mirrormanager/crawler/* (name="1.log") which are created by a cronjob.

sockets in /var/run/mirrormanager/.  There are 2 sockets types:
1) mirrorlist_server.py's socket, where mirrorlist_server is started by an initscript, or preferrably, supervisord.  This socket is opened for r/w by an apache WSGI process to make requests to the mirrorlist_server process. (name="mirrorlist-server.sock")

2) apache<->wsgi socket for running the mirrormanager web app wsgi, started by apache. (name="wsgi.$PID.*.sock")

and of course, logrotate on everything under /var/log/mirrormanager/* which are created by any process started under init, supervisord, or cron.

I also need cronjobs, command line scripts run as user mirrormanager, and my mirrormanager web app WSGi running under httpd to be able to read /etc/mirrormanager/* (specifically, prod.cfg).  

# ls -lZ /etc/mirrormanager/prod.cfg
-rw-r--r--. mirrormanager mirrormanager unconfined_u:object_r:etc_t:s0   /etc/mirrormanager/prod.cfg

This config file contains the database connection information, and various other config parameters.

commit 7a941ae3ab89c689489b73e1e42bf22e4bfd655a
Author: Lukas Vrabec <lvrabec>
Date:   Mon Jul 14 11:45:01 2014 +0200

    Allow apache to manage pid sock files BZ #1042864

Hi Karel, 

We are waiting for reaction in comment 13 then we move on with this bug.

Following 2 files are mentioned in /etc/httpd/conf.d/mirrormanager.conf and /etc/httpd/conf.d/mirrorlist-server.conf files. In both cases they are executed by mod_wsgi module of httpd.

# ls -l /usr/share/mirrormanager/server/mirrormanager.wsgi 
-rwxr-xr-x. 1 root root 1388 Mar 22  2010 /usr/share/mirrormanager/server/mirrormanager.wsgi
# ls -l /usr/share/mirrormanager/mirrorlist-server/mirrorlist_client.wsgi
-rwxr-xr-x. 1 root root 5505 Sep 12  2010 /usr/share/mirrormanager/mirrorlist-server/mirrorlist_client.wsgi
#

There are no AVCs. The problem is that WSGI scripts do not transition to correct domain:

:: [  BEGIN   ] :: Running 'ps -efZ | grep -v grep | grep "mirrormanager"'
unconfined_u:system_r:httpd_t:s0 498      5311  5300  0 12:46 ?        00:00:00 mirrormanager  
unconfined_u:system_r:httpd_t:s0 498      5312  5300  0 12:46 ?        00:00:00 mirrormanager  
unconfined_u:system_r:httpd_t:s0 498      5313  5300  0 12:46 ?        00:00:00 mirrormanager  
unconfined_u:system_r:httpd_t:s0 498      5314  5300  0 12:46 ?        00:00:00 mirrormanager  
:: [   PASS   ] :: Command 'ps -efZ | grep -v grep | grep "mirrormanager"' (Expected 0, got 0)
:: [  BEGIN   ] :: Running 'ps -efZ | grep -v grep | grep "mirrorlist"'
unconfined_u:system_r:httpd_t:s0 apache   5305  5300  0 12:46 ?        00:00:00 mirrorlist     
unconfined_u:system_r:httpd_t:s0 apache   5306  5300  0 12:46 ?        00:00:00 mirrorlist     
unconfined_u:system_r:httpd_t:s0 apache   5307  5300  0 12:46 ?        00:00:00 mirrorlist     
unconfined_u:system_r:httpd_t:s0 apache   5308  5300  0 12:46 ?        00:00:00 mirrorlist     
unconfined_u:system_r:httpd_t:s0 apache   5309  5300  0 12:46 ?        00:00:00 mirrorlist     
unconfined_u:system_r:httpd_t:s0 apache   5310  5300  0 12:46 ?        00:00:00 mirrorlist     
:: [   PASS   ] :: Command 'ps -efZ | grep -v grep | grep "mirrorlist"' (Expected 0, got 0)

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1375.html