Bug 1239198
| Summary: | RequestTracker Not Properly Configured with SELinux | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Joseph D. Wagner <joe> |
| Component: | rt | Assignee: | Ralf Corsepius <rc040203> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 21 | CC: | j, perl-devel, rc040203 |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-07-04 14:32:44 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Note that selinux policy issues should be filed against selinux-policy. There is, however, a longstanding ticket on this already. Also, a note that you can make the context change permanent with semanage fcontext -a -t httpd_sys_rw_content_t ' /var/cache/rt(/.*)?' restorecon -R -v /var/cache/rt *** This bug has been marked as a duplicate of bug 1185500 *** |
Description of problem: RequestTracker requires write access to /var/lib/rt for cache and session state information. Error from audit.log: type=AVC msg=audit(1435994355.726:771): avc: denied { getattr } for pid=6386 comm="/usr/sbin/rt-se" path="/var/cache/rt/mason_data/obj/.__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0 type=AVC msg=audit(1435994355.726:772): avc: denied { write } for pid=6386 comm="/usr/sbin/rt-se" name=".__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0 How reproducible: 100% Steps to Reproduce: 1. Take a working rt installation. 2. Reset labels on /var/lib/rt to defaults. 3. Go to website in browser. Actual results: An error message about an internal error. Expected results: A working system. Additional info: Problem can be fixed by running: # chcon -R -t httpd_sys_rw_content_t /var/cache/rt However, this only hold until the next relabel/restorecon.