Bug 1409014

Summary: bcfg2-server broken in 7.3
Product: [Fedora] Fedora EPEL Reporter: Gordon Messmer <gordon.messmer>
Component: bcfg2Assignee: Orphan Owner <extras-orphan>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: epel7CC: extras-orphan, john, lvrabec, mmalik, plautrba, pvrabec, ssekidde, tdawson
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-04-27 21:14:27 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1393066    
Attachments:
Description Flags
AVCs generated by startup and pull of single client none

Description Gordon Messmer 2016-12-28 23:18:33 UTC 
Description of problem:
The release of RHEL 7.3 includes changes to the bcfg2-server SELinux policy that completely break the application.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.7.noarch

How reproducible:
Always.

Steps to Reproduce:
1. Attempt to start bcfg2-server in enforcing mode.
2. Run bcfg2-server in permissive mode to observe many AVCs

Actual results:
SELinux prevents the startup and a number of normal operations of the bcfg2-server.

Expected results:
As in earlier releases, the software should function normally.

Additional info:
Comment 1 Gordon Messmer 2016-12-28 23:20:18 UTC 
Created attachment 1235760 [details]
AVCs generated by startup and pull of single client
Comment 3 Lukas Vrabec 2017-03-21 16:15:32 UTC 
This bugzilla was triaged as "WONTFIX" by the SELinux team, due to third-party software component which can be fixed by component maintainer. To take advantage of Mandatory Access Control mechanism provided by SELinux, you (component maintainer) can ship custom SELinux policy as a subpackage of  the affected component. As a starting point you can use policy provided by selinux-policy package. For more details  about the custom product policy, please follow the https://fedoraproject.org/wiki/SELinux/IndependentPolicy guideline.
Comment 4 Troy Dawson 2022-04-27 21:14:27 UTC 
bcfg2 is no longer in epel7.
Closing bug.