Bug 1185500

*** Bug 1239198 has been marked as a duplicate of this bug. ***

An end user reported the following AVC in the ticket I just closed as a duplicate:

type=AVC msg=audit(1435994355.726:771): avc:  denied  { getattr } for  pid=6386 comm="/usr/sbin/rt-se" path="/var/cache/rt/mason_data/obj/.__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0
type=AVC msg=audit(1435994355.726:772): avc:  denied  { write } for  pid=6386 comm="/usr/sbin/rt-se" name=".__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0

which should give enough info to at least fix the incorrect /var/cache/rt pattern.

Here's another one while trying to configure it.

SELinux is preventing /usr/sbin/httpd from write access on the file RT_SiteConfig.pm.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow httpd to have write access on the RT_SiteConfig.pm file
Then you need to change the label on RT_SiteConfig.pm
Do
# semanage fcontext -a -t FILE_TYPE 'RT_SiteConfig.pm'
where FILE_TYPE is one of the following: abrt_retrace_spool_t, afs_cache_t, anon_inodefs_t, apcupsd_cgi_rw_content_t, awstats_rw_content_t, bugzilla_rw_content_t, collectd_rw_content_t, cvs_rw_content_t, dirsrv_config_t, dirsrv_var_log_t, dirsrv_var_run_t, dirsrvadmin_config_t, dirsrvadmin_rw_content_t, dirsrvadmin_tmp_t, dspam_rw_content_t, git_rw_content_t, httpd_cache_t, httpd_lock_t, httpd_squirrelmail_t, httpd_sys_rw_content_t, httpd_tmp_t, httpd_tmpfs_t, httpd_user_rw_content_t, httpd_var_lib_t, httpd_var_run_t, initrc_tmp_t, jetty_cache_t, jetty_log_t, jetty_var_lib_t, jetty_var_run_t, keystone_cgi_rw_content_t, krb5_host_rcache_t, man2html_rw_content_t, mediawiki_rw_content_t, mirrormanager_var_run_t, mojomojo_rw_content_t, munin_rw_content_t, mythtv_rw_content_t, nagios_rw_content_t, nutups_cgi_rw_content_t, openshift_rw_content_t, passenger_tmp_t, passenger_var_run_t, pki_ra_etc_rw_t, pki_ra_log_t, pki_ra_var_lib_t, pki_tps_etc_rw_t, pki_tps_log_t, pki_tps_var_lib_t, postfix_spool_maildrop_t, prewikka_rw_content_t, puppet_tmp_t, security_t, smokeping_cgi_rw_content_t, squid_rw_content_t, squirrelmail_spool_t, systemd_passwd_var_run_t, user_cron_spool_t, w3c_validator_rw_content_t, webalizer_rw_content_t, zarafa_var_lib_t, zoneminder_rw_content_t, zoneminder_var_lib_t. 
Then execute: 
restorecon -v 'RT_SiteConfig.pm'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that httpd should be allowed write access on the RT_SiteConfig.pm file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep /usr/sbin/httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                RT_SiteConfig.pm [ file ]
Source                        /usr/sbin/httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           httpd-2.4.6-31.el7.centos.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-23.el7_1.8.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              3.10.0-229.7.2.el7.x86_64 #1 SMP Tue Jun 23
                              22:06:11 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-07-23 13:24:53 PDT
Last Seen                     2015-07-23 13:24:53 PDT
Local ID                      a78efbfc-0381-4ddb-b17b-f156602f83d0

Raw Audit Messages
type=AVC msg=audit(1437683093.679:167): avc:  denied  { write } for  pid=3273 comm="/usr/sbin/httpd" name="RT_SiteConfig.pm" dev="vda2" ino=163061 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file


type=SYSCALL msg=audit(1437683093.679:167): arch=x86_64 syscall=open success=no exit=EACCES a0=7fd10f77e260 a1=241 a2=1b6 a3=0 items=0 ppid=3268 pid=3273 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=/usr/sbin/httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: /usr/sbin/httpd,httpd_t,etc_t,file,write

Where is RT_SiteConfig.pm located in /etc?

/etc/rt

Interestingly, I did not get this error when setting it up on Fedora 21. I only got it on RHEL 7.1.

Here are the customizations I ended up using:
fcontext -a -f a -t httpd_cache_t '/var/cache/rt(/.*)?'
fcontext -a -f a -t httpd_var_lib_t '/var/lib/rt(/.*)?'
fcontext -a -f a -t httpd_log_t '/var/log/rt(/.*)?'

I'm reasonably confident those are solid. I just finished installing the RT web site (not the mailgate) on a production system.  In the next few weeks, I should have a pretty good idea if there's any breakage.

Looks like /etc/rt needs a label like httpd_sys_content_rw_t

commit 432543034a05accafe43bb372e74f347e262115a
Author: Lukas Vrabec <lvrabec>
Date:   Tue Jul 28 15:14:03 2015 +0200

    Label /etc/rt dir as httpd_sys_rw_content_t
    BZ(#1185500)

selinux-policy-3.13.1-140.fc23 has been submitted as an update for Fedora 23.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-140.fc23

selinux-policy-3.13.1-140.fc23 has been pushed to the Fedora 23 stable repository.  If problems still persist, please make note of it in this bug report.