Bug 1549514
| Summary: | /var/log/shibboleth-www(/.*) needs httpd_sys_content_rw_t | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Benjamin Lefoul <lef> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | dapospis, dmulford, lvrabec, mgrepl, mmalik, moremellotron, nbhumkar, plautrba, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 10:02:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Benjamin Lefoul
2018-02-27 10:11:58 UTC
Typo, I meant httpd_sys_rw_content_t, not httpd_sys_content_rw_t! I'm not sure why this is a Red Hat bug, and would suggest it be closed. The only packages for Shibboleth for Red Hat are provided by the Shibboleth Project, and our policy on SELinux remains "not supported", so other than noting it as an input to an issue in our JIRA for future tracking purposes, there's really no bug here, nor any issue for Red Hat. Or I'm just confused, but since my name got dragged into the bug... (In reply to Scott Cantor from comment #4) > I'm not sure why this is a Red Hat bug, and would suggest it be closed. The > only packages for Shibboleth for Red Hat are provided by the Shibboleth > Project, and our policy on SELinux remains "not supported", so other than > noting it as an input to an issue in our JIRA for future tracking purposes, > there's really no bug here, nor any issue for Red Hat. > > Or I'm just confused, but since my name got dragged into the bug... Hi Scott, I CCed because I thought you might be interested. I found your email in the src.rpm's changelog. This is not a feature request for shibboleth (which is indeed unsupported) but for the selinux-policy RPM. If you look at the man page for apache_selinux on RHEL, there are many directories listed with type httpd_sys_rw_content_t and canonically created by software not supported by Red Hat. As far as I can tell, adding /var/log/shibboleth-www(/.*) to that list should not be a problem, and I think that handles all SELinux denials I have come across with shibboleth. If you think this should be closed that's fine, but then I'll probably just ask one step upstream on the fedora fork of the reference policy where the maintainers are essentially the same as here... Ah, thanks for clarifying. Just my ignorance of SELinux, I didn't understand the request you were making. If they do include third party directories, that's fine, that's a stable location, but I will say we're almost certainly switching the default native.logger sink for 3.0 to go to syslog anyway. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3111 |