Bug 2000424

Summary:	Backport pulp systemd service check in ping
Product:	Red Hat Satellite	Reporter:	Lukas Zapletal <lzap>
Component:	SELinux	Assignee:	Lukas Zapletal <lzap>
Status:	CLOSED ERRATA	QA Contact:	Lukas Pramuk <lpramuk>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.9.0	CC:	lzap, pcreech, tbrisker
Target Milestone:	6.10.0	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	katello-selinux-4.0.2-1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-16 14:13:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lukas Zapletal 2021-09-02 06:44:23 UTC

This was reported via 6.9 HTB in https://bugzilla.redhat.com/show_bug.cgi?id=1991030

One of the SELinux denials was preventing Katello ping controller to perform

systemctl is-enabled pulpcore-api.service

This has been fixed upstream both in Katello and Katello SELinux policy. Please backport these three commits:

* https://projects.theforeman.org/issues/32787
* https://projects.theforeman.org/issues/32765

The SELinux patch had two commits, so three in total:

* https://github.com/Katello/katello/pull/9403/files
* https://github.com/Katello/katello-selinux/pull/34/files
* https://github.com/Katello/katello-selinux/pull/37/files

Ping me if you need backporting assistance, this should be pretty straightforward tho. Thanks

Comment 1 Lukas Pramuk 2021-10-14 21:05:41 UTC

VERIFIED.

@Satellite 6.10.0 Snap23
katello-selinux-4.0.2-1.el7sat.noarch

by the following manual steps:

# hammer ping
database:         
    Status:          ok
    Server Response: Duration: 0ms
candlepin:        
    Status:          ok
    Server Response: Duration: 62ms
candlepin_auth:   
    Status:          ok
    Server Response: Duration: 66ms
candlepin_events: 
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
katello_events:   
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
pulp3:            
    Status:          ok
    Server Response: Duration: 424ms
foreman_tasks:    
    Status:          ok
    Server Response: Duration: 5ms

# audit2allow -a
<empty>

Comment 4 errata-xmlrpc 2021-11-16 14:13:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4702