Bug 2172833

Summary:	SELinux errors in journal during content-export
Product:	Red Hat Satellite	Reporter:	Vladimír Sedmík <vsedmik>
Component:	Pulp	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	NEW ---	QA Contact:	Satellite QE Team <sat-qe-bz-list>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.13.0	CC:	egolov, ehelms
Target Milestone:	Unspecified	Keywords:	Triaged, WorkAround
Target Release:	Unused
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vladimír Sedmík 2023-02-23 09:17:58 UTC

Description of problem:
When performing a content export, the export succeeds but SELinux denial errors are logged in journal.


Version-Release number of selected component (if applicable):
6.13.0 snap 11


How reproducible:
always


Steps to Reproduce:
1. Have a Satellite with some content synced.
2. Run content export (no matter the type nor format)
# hammer content-export complete repository --format importable --organization-id 1 --id 2


Actual results:
Errors like following seen in journal:
Feb 23 04:06:05 satellite.redhat.com /SetroubleshootPrivileged.py[37552]: failed to retrieve rpm info for /var/lib/selinux/targeted/active/modules/400/pulpcore
Feb 23 04:06:09 satellite.redhat.com setroubleshoot[37536]: SELinux is preventing /usr/bin/python3.9 from write access on the directory Export-<product_name>. For complete SELinux messages run: sealert -l fb7d5ec5-a1b6-4cef-855c-1232d8dc0533


Expected results:
No such errors in journal.


Additional info:
Setting fcontext to pulpcore_var_lib_t for the particular directory resolves the issue:
# semanage fcontext -a -t pulpcore_var_lib_t /var/lib/pulp/exports/Default_Organization/Export-<product_name>
# restorecon -v /var/lib/pulp/exports/Default_Organization/Export-<product_name>

Comment 1 Eric Helms 2023-08-03 12:58:43 UTC

As this was reported a while back on a snap, is this still an issue being seen on 6.13 GA or 6.14 development builds?

Comment 2 Vladimír Sedmík 2023-08-04 11:58:05 UTC

Yes, the issue has been just reproduced on 6.14.0 snap 10 and 6.13.3 snap 2:

Aug 04 07:55:45 satellite.redhat.com /SetroubleshootPrivileged.py[11396]: failed to retrieve rpm info for /var/lib/selinux/targeted/active/modules/400/pulpcore
Aug 04 07:55:47 satellite.redhat.com setroubleshoot[11368]: SELinux is preventing /usr/bin/python3.9 from write access on the directory labeled var_lib_t. For complete SELinux messages run: sealert -l 66186877-c5c6-455f-ad29-6c58aee48b31

Comment 3 Evgeni Golov 2023-08-10 13:01:05 UTC

@Pulp Team:
/var/lib/pulp/export is something that Katello/Satellite defines as a default export path (https://github.com/theforeman/puppet-foreman_proxy_content/blob/96258dd5e8a36e9f94e6ba7d3a04bcbfbfd7a57c/manifests/init.pp#L238)
However, we think now that Pulp2 is dead-dead-dead, https://github.com/pulp/pulpcore-selinux/blob/main/pulpcore.fc#L18-L24 can be simplified to something like
/var/lib/pulp(/.*)?	gen_context(system_u:object_r:pulpcore_var_lib_t,s0)
/var/lib/pulp/pulpcore_static(/.*)? 	gen_context(system_u:object_r:httpd_sys_content_t,s0)

Comment 4 Evgeni Golov 2023-08-10 13:02:13 UTC

Ewoud opened a nice PR for that change: https://github.com/pulp/pulpcore-selinux/pull/69