Bug 1105085

Summary:	Katello ping controller executes init scripts
Product:	Red Hat Satellite	Reporter:	Lukas Zapletal <lzap>
Component:	API	Assignee:	Ivan Necas <inecas>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Kedar Bidarkar <kbidarka>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	Nightly	CC:	bbuckingham, bkearney, cwelton, inecas, jmontleo, kbidarka, lzap, sthirugn
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
URL:	http://projects.theforeman.org/issues/6283
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-11 12:25:52 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lukas Zapletal 2014-06-05 10:54:45 UTC

Model class app/models/katello/ping.rb executes /etc/init.d/katello-jobs. This is security concern.

I am allowing this in our SELinux policy for now, because katello-jobs service will be removed for GA and it will be replaced by dynflow engine. All other services are checked with their API, I expect the same for dynflow so no services are needed to be executed at all.

Please remove this exec for GA once dynflow engine replace katello-jobs. Once this task is done, please raise a BZ on SELinux component to remove the rules.

PM: Please waive this for GA not Beta.

Comment 1 RHEL Program Management 2014-06-05 11:13:35 UTC

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 3 Dominic Cleal 2014-06-19 10:11:14 UTC

Created redmine issue http://projects.theforeman.org/issues/6283 from this bug

Comment 7 Kedar Bidarkar 2014-08-25 11:07:22 UTC

please provide the verification steps for this bug.

Comment 8 Lukas Zapletal 2014-08-25 15:51:42 UTC

Please just make sure "ping" CLI command works. Created upstream low priority ticket to remove this rule:

http://projects.theforeman.org/issues/7250

Comment 9 Kedar Bidarkar 2014-08-26 10:40:23 UTC

[root@xxxx ~]# hammer ping 
candlepin:      
    Status:          ok
    Server Response: Duration: 100ms
candlepin_auth: 
    Status:          ok
    Server Response: Duration: 88ms
pulp:           
    Status:          ok
    Server Response: Duration: 36ms
pulp_auth:      
    Status:          ok
    Server Response: Duration: 48ms
elasticsearch:  
    Status:          ok
    Server Response: Duration: 31ms
foreman_tasks:  
    Status:          ok
    Server Response: Duration: 1ms

[root@xxxx ~]# cat /etc/yum/vars/composeid 
Satellite-6.0.4-RHEL-6-20140823.0
[root@xxxx ~]# getenforce
Enforcing

Comment 10 Kedar Bidarkar 2014-08-26 10:41:42 UTC

Tested with sat6-GA-snap6-compose3



Installed Packages

    candlepin-0.9.23-1.el6_5.noarch
    candlepin-common-1.0.1-1.el6_5.noarch
    candlepin-scl-1-5.el6_4.noarch
    candlepin-scl-quartz-2.1.5-5.el6_4.noarch
    candlepin-scl-rhino-1.7R3-1.el6_4.noarch
    candlepin-scl-runtime-1-5.el6_4.noarch
    candlepin-selinux-0.9.23-1.el6_5.noarch
    candlepin-tomcat6-0.9.23-1.el6_5.noarch
    createrepo-0.9.9-21.2.pulp.el6sat.noarch
    elasticsearch-0.90.10-6.el6sat.noarch
    katello-1.5.0-29.el6sat.noarch
    katello-certs-tools-1.5.6-1.el6sat.noarch
    katello-default-ca-1.0-1.noarch
    katello-installer-0.0.61-1.el6sat.noarch
    katello-server-ca-1.0-1.noarch
    m2crypto-0.21.1.pulp-10.el6sat.x86_64
    mod_wsgi-3.4-1.pulp.el6sat.x86_64
    pulp-katello-0.3-3.el6sat.noarch
    pulp-nodes-common-2.4.0-0.30.beta.el6sat.noarch
    pulp-nodes-parent-2.4.0-0.30.beta.el6sat.noarch
    pulp-puppet-plugins-2.4.0-0.30.beta.el6sat.noarch
    pulp-puppet-tools-2.4.0-0.30.beta.el6sat.noarch
    pulp-rpm-plugins-2.4.0-0.30.beta.el6sat.noarch
    pulp-selinux-2.4.0-0.30.beta.el6sat.noarch
    pulp-server-2.4.0-0.30.beta.el6sat.noarch
    python-gofer-qpid-1.3.0-1.el6sat.noarch
    python-isodate-0.5.0-1.pulp.el6sat.noarch
    python-kombu-3.0.15-12.pulp.el6sat.noarch
    python-pulp-bindings-2.4.0-0.30.beta.el6sat.noarch
    python-pulp-common-2.4.0-0.30.beta.el6sat.noarch
    python-pulp-puppet-common-2.4.0-0.30.beta.el6sat.noarch
    python-pulp-rpm-common-2.4.0-0.30.beta.el6sat.noarch
    python-qpid-0.22-14.el6sat.noarch
    python-qpid-qmf-0.22-37.el6.x86_64
    qpid-cpp-client-0.22-42.el6.x86_64
    qpid-cpp-server-0.22-42.el6.x86_64
    qpid-cpp-server-linearstore-0.22-42.el6.x86_64
    qpid-java-client-0.22-6.el6.noarch
    qpid-java-common-0.22-6.el6.noarch
    qpid-proton-c-0.7-1.el6.x86_64
    qpid-qmf-0.22-37.el6.x86_64
    qpid-tools-0.22-12.el6.noarch
    ruby193-rubygem-katello-1.5.0-85.el6sat.noarch
    rubygem-hammer_cli_katello-0.0.4-14.el6sat.noarch
    rubygem-smart_proxy_pulp-1.0.1-1.1.el6sat.noarch

Comment 11 Bryan Kearney 2014-09-11 12:25:52 UTC

This was delivered with Satellite 6.0 which was released on 10 September 2014.