Bug 1191504

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Hey,

for some reason we are missing the following rules:

        allow celery_t puppet_etc_t:lnk_file create;
        manage_dirs_pattern(celery_t, puppet_etc_t, puppet_etc_t)
        manage_files_pattern(celery_t, puppet_etc_t, puppet_etc_t)

I see those in the upstream pulp policy and I also see a boolean flag which is being turned on by our installer:

semanage boolean -l | grep pulp
pulp_manage_puppet             (on   ,   on)  pulp_manage_puppet

The bug stems from the fact that the moment celery policy is being loaded puppet policy is not yet loaded. We need to load it first. A patch into pulp will follow, but I am not able to workaround this in Satellite 6, therefore we need to backport this into celery policy. I will switch over this to Pulp component once confirmed.

QA: To VERIFY this bug:

1) install pulp with SELinux package
2) check that "semanage boolean -l | grep pulp" shows "on + on"
3) check that "sesearch -A -s celery_t -C | grep manage" actually lists some rules (should not be empty)

FYI it is this block which is being ignored by optional_policy:

https://github.com/pulp/pulp/blob/master/server/selinux/server/pulp-celery.te#L122-L130

So either the puppet was missing and the solution would be to do this in the enable.sh script:

(semodule -l | grep -qE '^puppet\s+') && semodule -i puppet

But in that case I'd expect it to fail in the require { type puppet_etc_t } section rather than the optional block.

OR

There is a bug in the optional block so the policy wont compile it. To fix this remove the optional block, try to recomile if there is a syntax error.

I removed the optional block and it compiles just fine on my system. The problem must be that you don't have puppet module loaded when COMPILING the stuff in brew. Can you check this and make sure it is being loaded?

As I understand it optional policies are compiled with the normal SELinux policy, but they can be enabled/disabled using `semanage boolean`.

Here [0] are the upstream Pulp docs that talk about this area of the SELinux policy.

[0]:  http://pulp-puppet-dev-guide.readthedocs.org/en/latest/plugin_conf.html#install-distributor

Ok I was wrong.

https://github.com/pulp/pulp/commit/a3e8a2464f2939fade6f2a79d4680e03aa53e7b1

Backport this patch into branch/release we base Satellite 6.2 pulp off.

This has nothing to do with optional_blocks. It is as simple as that.

But please doublecheck you correctly require this:

Requires(post): selinux-policy-targeted >= 3.12.1-74

From the pulp.spec I can only tell that this require is present only for Fedoras. We need it for RHEL as well.

I suggest to ship .te files along with policy for better transparency either directly with pulp-selinux (that's what we do in our packages) or in the -doc subpackage.

Reproducer without Satellite 6.2:

A) semanage boolean -m --on pulp_manage_puppet
B) sesearch -A -s celery_t -t puppet_etc_t

The last commant shows no rules.

Expected: At least three rules there.

Putting this back to Satellite so that downstream can track it.

Please open a new bug or clone this one against the Pulp product. The satellite bug needs to be blocked by the Pulp bug. The Pulp bug needs reproducer steps that involve non-satellite things. The Pulp bug should not contain the 'Triaged' keyword. Also the satellite BZ needs to get put onto the right satellite tracker, but that is a downstream concern. That should ensure that its included by rel-eng.

So for the Pulp upstream bug, how do I reproduce this with Pulp? If I install Pulp 2.6.0 and run (A) and (B) I'll see no denials because I haven't asked Pulp to do anything yet. There does seem like Pulp needs to make a SELinux adjustment, but but I'm not sure what the actual bug symptom is in Pulp terms.

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Hey,

you followed reproducer steps correctly, but with wrong Pulp version. Satellite 6.1 ships with pulp-2.5.0, that's what I see in our downstream repo. Try that again with the correct version.

Filed: https://bugzilla.redhat.com/show_bug.cgi?id=1192447

Please s/6.2/6.1/g - I am talking about 6.1 here. My mind a bit too ahead :-)

We are getting 2.6 in the next snap and I updated the Summary to accurately reflect the bug vs the solution

Moving this to ON_QA.

This bug is slated to be released with Satellite 6.1.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:1592