Bug 667800
| Summary: | SELinux is preventing /usr/bin/python "write" access on cobbler. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Per Sjoholm <Per.t.Sjoholm> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | dwalsh, mgrepl, Per.t.Sjoholm |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:b64b32c9de334c25e16252deb1e1449563311191c64ca48c4c2c44a540aad47b | ||
| Fixed In Version: | selinux-policy-3.9.7-25.fc14 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-01-25 20:58:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Per Sjoholm
2011-01-06 20:08:55 UTC
cobbler sync
task started: 2011-01-06_210548_sync
task started (id=Sync, time=Thu Jan 6 21:05:48 2011)
running pre-sync triggers
cleaning trees
removing: /var/www/cobbler/pub
removing: /var/lib/tftpboot/grub/images
removing: /var/lib/tftpboot/grub/grub-x86.efi
Exception occured: <type 'exceptions.OSError'>
Exception value: [Errno 13] Permission denied: '/var/lib/tftpboot/grub/grub-x86.efi'
Exception Info:
File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1180, in rmfile
os.unlink(path)
Exception occured: <class 'cobbler.cexceptions.CX'>
Exception value: 'Error deleting /var/lib/tftpboot/grub/grub-x86.efi'
Exception Info:
File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 95, in run
rc = self._run(self)
File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 184, in runner
return self.remote.api.sync(self.options.get("verbose",False),logger=self.logger)
File "/usr/lib/python2.6/site-packages/cobbler/api.py", line 610, in sync
return sync.run()
File "/usr/lib/python2.6/site-packages/cobbler/action_sync.py", line 110, in run
self.clean_trees()
File "/usr/lib/python2.6/site-packages/cobbler/action_sync.py", line 199, in clean_trees
utils.rmtree_contents(self.grub_dir,logger=self.logger)
File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1192, in rmtree_contents
rmtree(x,logger=logger)
File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1197, in rmtree
return rmfile(path,logger=logger)
File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1186, in rmfile
raise CX(_("Error deleting %s") % path)
!!! TASK FAILED !!!
Looks like /var/lib/tftpboot/grub needs to be labeled correctly. /var/lib/tftpboot/grub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) When installing cobbler I run cobbler check 3 : you need to set some SELinux content rules to ensure cobbler serves content correctly in your SELinux environment, run the following: /usr/sbin/semanage fcontext -a -t public_content_t "/var/lib/tftpboot/.*" && /usr/sbin/semanage fcontext -a -t public_content_t "/var/www/cobbler/images/.*" 4 : you need to set some SELinux rules if you want to use cobbler-web (an optional package), run the following: /usr/sbin/semanage fcontext -a -t httpd_sys_content_rw_t "/var/lib/cobbler/webui_sessions/.*" After following instructions cobbler check The following are potential configuration items that you may want to fix: 1 : you need to set some SELinux content rules to ensure cobbler serves content correctly in your SELinux environment, run the following: /usr/sbin/semanage fcontext -a -t public_content_t "/var/lib/tftpboot/.*" && /usr/sbin/semanage fcontext -a -t public_content_t "/var/www/cobbler/images/.*" 2 : you need to set some SELinux rules if you want to use cobbler-web (an optional package), run the following: /usr/sbin/semanage fcontext -a -t httpd_sys_content_rw_t "/var/lib/cobbler/webui_sessions/.*" A note is that cobbler replaced my named.conf without asking or saving. Per, try to execute chcon -R -t cobbler_var_lib_t /var/lib/tftpboot/grub Should fix for now. Fixed in selinux-policy-3.7.19-81.fc13 I have opened a new cobbler bug to remove these invalid instructions. https://bugzilla.redhat.com/show_bug.cgi?id=667933 selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14 selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14 selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. |