Bug 1671534

Description of problem:

When the rhsmcertd-worker runs to auto heal a system with a subscription that provides content of type "containerImage", the granted entitlement cert and key are supposed to be copied to all the registry_hostnames directories configured in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf.

The problem on RHEL8 is that rhsm.log indicates a WARNING that "Container cert directory does not exist: /etc/docker/certs.d" when it does indeed exist.  This is blocking the subscription-manager-plugin-container from copying certificates from /etc/pki/entitlement/ to /etc/docker/certs.d/<registry_hostnames>/

Note 1: When manually attaching a subscription that provides "containerImage" content, the subscription-manager-plugin-container successfully copies the entitlement cert&key without any warnings in the rhsm.log.

Note 2: When selinux is running in permissive mode, the rhsmcertd-worker successfully copies the entitlement certs.

Note 3: When selinux is in enforcing mode, rhsmcertd-worker fails to copy entitlement certs, yet I cannot find any denials in the audit log.



Version-Release number of selected component (if applicable):
[root@kvm-01-guest17 ~]# rpm -q subscription-manager-plugin-container selinux-policy
subscription-manager-plugin-container-1.23.8-15.el8.x86_64
selinux-policy-3.14.1-53.el8.noarch


How reproducible:
always


Steps to Reproduce:
This testing is being done against an onpremise candlepin server with the TESTDATA deployed and product certs from the TESTDATA installed.


[root@kvm-01-guest17 ~]# subscription-manager config --rhsmcertd.splay=0 --rhsmcertd.disable=0
[root@kvm-01-guest17 ~]# service auditd restart
Stopping logging:                                          [  OK  ]
Redirecting start to /bin/systemctl start auditd.service
[root@kvm-01-guest17 ~]# setenforce 1
[root@kvm-01-guest17 ~]# restorecon -Rv /etc /run /var
Relabeled /etc/dnf/modules.d/virt.module from system_u:object_r:root_t:s0 to system_u:object_r:etc_t:s0
Relabeled /run/user/0 from system_u:object_r:tmpfs_t:s0 to system_u:object_r:user_tmp_t:s0
[root@kvm-01-guest17 ~]# START_DATE_TIME=`date "+%m/%d/%Y %T"`
[root@kvm-01-guest17 ~]# systemctl restart rhsmcertd
[root@kvm-01-guest17 ~]# sleep 120
[root@kvm-01-guest17 ~]# ausearch -m AVC -m USER_AVC -m SELINUX_ERR -i -ts ${START_DATE_TIME}
<no matches>
[root@kvm-01-guest17 ~]# cat /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf
[main]
enabled = 1
registry_hostnames=registry.access.redhat.com,cdn.redhat.com,access.redhat.com,registry.redhat.io,cdn.rhsm-test.redhat.com,rhsm-test.redhat.com
[root@kvm-01-guest17 ~]# ls /etc/docker/certs.d/*
/etc/docker/certs.d/access.redhat.com:

/etc/docker/certs.d/cdn.redhat.com:
redhat-entitlement-authority.crt

/etc/docker/certs.d/cdn.rhsm-test.redhat.com:
redhat-entitlement-authority.crt

/etc/docker/certs.d/registry.access.redhat.com:

/etc/docker/certs.d/registry.redhat.io:

/etc/docker/certs.d/rhsm-test.redhat.com:
[root@kvm-01-guest17 ~]# 
[root@kvm-01-guest17 ~]# subscription-manager list --consumed | grep "Awesome OS Docker" -A16
Subscription Name:   Awesome OS Docker
Provides:            Awesome OS Docker Bits
SKU:                 awesomeos-docker
Contract:            0
Account:             12331131231
Serial:              3336717941861560708
Pool ID:             8a88714e68a53f5d0168a53fb7f901e6
Provides Management: No
Active:              True
Quantity Used:       1
Service Level:       
Service Type:        
Status Details:      Subscription is current
Subscription Type:   Standard
Starts:              01/30/2019
Ends:                01/30/2020
System Type:         Physical

[root@kvm-01-guest17 ~]# rct cat-cert /etc/pki/entitlement/3336717941861560708.pem | grep -i containerImage -A1 -B1
Content:
	Type: containerImage
	Name: awesomeos-docker-images
[root@kvm-01-guest17 ~]# 


FAILED: EXPECTED THE DIRECTORIES DEFINED BY registry_hostnames TO BE POPULATED WITH THE ENTITLEMENT SERIAL FROM Awesome OS Docker BECAUSE IT PROVIDES "containerImage" CONTENT.




Additional info:

[root@kvm-01-guest17 ~]# tail -f /var/log/rhsm/rhsm.log  | grep WARNING
2019-01-31 14:34:49,393 [WARNING] rhsmcertd-worker:4969:MainThread @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2019-01-31 14:34:49,393 [WARNING] rhsmcertd-worker:4969:MainThread @container.py:141 - Exiting plugin



[root@kvm-01-guest17 ~]# tail -f /var/log/rhsm/rhsmcertd.log 
Thu Jan 31 14:32:48 2019 [INFO] rhsmcertd is shutting down...
Thu Jan 31 14:32:48 2019 [INFO] Starting rhsmcertd...
Thu Jan 31 14:32:48 2019 [INFO] Auto-attach interval: 1440.0 minutes [86400 seconds]
Thu Jan 31 14:32:48 2019 [INFO] Cert check interval: 240.0 minutes [14400 seconds]
Thu Jan 31 14:32:48 2019 [INFO] Waiting 2.0 minutes plus 0 splay seconds [120 seconds total] before performing first auto-attach.
Thu Jan 31 14:32:48 2019 [INFO] Waiting 2.0 minutes plus 0 splay seconds [120 seconds total] before performing first cert check.
Thu Jan 31 14:34:49 2019 [INFO] (Cert Check) Certificates updated.
Thu Jan 31 14:34:51 2019 [INFO] (Auto-attach) Certificates updated.