Bug 670894

Summary: cobblerd and httpd have many denials
Product: [Fedora] Fedora Reporter: Michael Cronenworth <mike>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 14CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.9.7-25.fc14 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-01-25 20:58:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
cobblerd policy none

Description Michael Cronenworth 2011-01-19 15:48:40 UTC 
Created attachment 474303 [details]
cobblerd policy

Description of problem: cobbler is not usable in its current state. It should have been obvious to anyone using cobbler/SELinux/Fedora 14 that you can't use it at all. I've reported other bugs (bug 664749, bug 670855, and bug 670864). Could someone with the SELinux crew please install a Fedora 14 VM and cobbler before adding more rules blindly?

There's frankly too many denials to make 3 or 4 more bugs about this issue. I have attached the custom policy that I had to create to get cobbler going. The policy does not include the rules for httpd from bug 670864.


Version-Release number of selected component (if applicable):
cobbler-2.0.10-1.fc14.noarch
selinux-policy-3.9.7-20.fc14.noarch
selinux-policy-targeted-3.9.7-20.fc14.noarch

How reproducible: Always


Steps to Reproduce:
1. Install Fedora 14, SELinux enforcing, install cobbler.
2. Bring up Firefox and go to cobbler web interface.
3. Try to login, click on "Sync" button, view kickstart templates, etc. All links should work.
  
Actual results: Cobbler flat out not working. Every SELinux update or cobbler update breaks something. It's like no one is QA'ing the thing at all. I don't have a weird, custom setup so these problems should be visible to anyone.


Expected results: Cobbler web interface working.


Additional info:

I've created custom policies to get me by for now.
Comment 1 Daniel Walsh 2011-01-19 16:00:58 UTC 
We would prefer the avc messages, since we can tell whether or not there is a labelling issue.

allow cobblerd_t tftpdir_rw_t:file unlink;
allow cobblerd_t tftpdir_rw_t:file { read write getattr };
allow cobblerd_t tftpdir_rw_t:lnk_file { read getattr };

These I believe are caused by a mislabled /var/lib/tftpboot/grub  Which should be fixed in the latest f14 policy currently in updates-testing, I believe.
Comment 2 Daniel Walsh 2011-01-19 16:02:03 UTC 
chcon -t cobbler_var_lib_t -R /var/lib/tftpboot/grub

Should fix for now.
Comment 3 Daniel Walsh 2011-01-19 16:09:47 UTC 
The first two bugs look like we have marked them as fixed in policy.  We rely
on the cobbler maintainers to make sure SELinux does not break when they
update.  We can not know what is going to break and try to react as fast as
possible.
Comment 4 Daniel Walsh 2011-01-19 16:10:53 UTC 
Miroslav it looks like the cobbler fixes need to be back ported to F13-Rawhide and put into RHEL6.
Comment 5 Miroslav Grepl 2011-01-19 16:22:56 UTC 
Fixed in selinux-policy-3.9.7-22.fc14
Comment 6 Fedora Update System 2011-01-20 16:04:26 UTC 
selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
Comment 7 Fedora Update System 2011-01-20 19:54:49 UTC 
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
Comment 8 Michael Cronenworth 2011-01-25 14:42:58 UTC 
The cobbler issues are fixed with selinux-policy-3.9.7-25.fc14.

Thanks.
Comment 9 Fedora Update System 2011-01-25 20:57:48 UTC 
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.