Bug 683377

Created attachment 483143 [details]
pxe_installation_permission_denied picture

Please test with the 6.1 policy  selinux-policy-3.7.19-79.el6

This is allowed in that policy.

Yes, the latest RHEL6 policy has a lot of fixes for cobbler/tftp/dnsmasq.

The bug has been verified on rhel6.1(2.6.32-120.el6.x86_64) with selinux-policy-3.7.19-79.el6.noarch, I can successfully install libvirt guest by pxe method with selinux enable, so set bug status to VERIFIED.


# rpm -qa | grep tftp
tftp-0.49-5.1.el6.x86_64
tftp-server-0.49-5.1.el6.x86_64

# ps -eZ | grep dnsmasq
system_u:system_r:dnsmasq_t:s0-s0:c0.c1023 2068 ? 00:00:00 dnsmasq
system_u:system_r:dnsmasq_t:s0-s0:c0.c1023 6074 ? 00:00:00 dnsmasq

# ll -Z /var/lib/tftpboot/
-rw-r--r--. root root unconfined_u:object_r:tftpdir_rw_t:s0 initrd.img
-rw-r--r--. root root unconfined_u:object_r:tftpdir_rw_t:s0 pxelinux.0
drwxr-xr-x. root root unconfined_u:object_r:tftpdir_rw_t:s0 pxelinux.cfg
-rw-r--r--. root root unconfined_u:object_r:tftpdir_rw_t:s0 vmlinuz

(In reply to comment #3)
> Yes, the latest RHEL6 policy has a lot of fixes for cobbler/tftp/dnsmasq.

Hi Daniel and Miroslav,
when I default install tftp-server package on local machine, /var/lib/tfpboot is 
owned by root with system_u:object_r:var_lib_t:s0 label, I need to manually recursively change label type from var_lib_t to tftpdir_rw_t, otherwise, I still will met permission denied issue, is this a expected result?

Alex

What does 
matchpathcon /var/lib/tftpboot/ 

say?

If you run 
restorecon -R -v /var/lib/tftpboot 
does it fix the label?

What does 

rpm -qf /var/lib/tftpboot

(In reply to comment #6)
> What does 
> matchpathcon /var/lib/tftpboot/ 
> 
> say?
# matchpathcon /var/lib/tftpboot/ 
/var/lib/tftpboot	system_u:object_r:tftpdir_rw_t:s0

# ll -Z /var/lib/tftpboot/
-rw-rw-rw-. root root system_u:object_r:var_lib_t:s0   initrd.img
-rw-r--r--. root root system_u:object_r:var_lib_t:s0   pxelinux.0
drwxrwxrwx. root root system_u:object_r:var_lib_t:s0   pxelinux.cfg
-rw-rw-rw-. root root system_u:object_r:var_lib_t:s0   vmlinuz
> 
> If you run 
> restorecon -R -v /var/lib/tftpboot 
> does it fix the label?

# restorecon -R -v /var/lib/tftpboot
restorecon reset /var/lib/tftpboot/initrd.img context system_u:object_r:var_lib_t:s0->system_u:object_r:tftpdir_rw_t:s0
restorecon reset /var/lib/tftpboot/vmlinuz context system_u:object_r:var_lib_t:s0->system_u:object_r:tftpdir_rw_t:s0
restorecon reset /var/lib/tftpboot/pxelinux.cfg context system_u:object_r:var_lib_t:s0->system_u:object_r:cobbler_var_lib_t:s0
restorecon reset /var/lib/tftpboot/pxelinux.cfg/default context system_u:object_r:var_lib_t:s0->system_u:object_r:cobbler_var_lib_t:s0
restorecon reset /var/lib/tftpboot/pxelinux.0 context system_u:object_r:var_lib_t:s0->system_u:object_r:cobbler_var_lib_t:s0
> 
> What does 
> 
> rpm -qf /var/lib/tftpboot

# rpm -qf /var/lib/tftpboot
tftp-server-0.49-5.1.el6.x86_64


And I can successfully install libvirt guest os by pxe method after running restorecon -R -v /var/lib/tftpboot, so Must I manually do this action before installing guest os? 

BTW, I renew installed tftp and tftp-server package, and I haven't changed any label for /var/lib/tftpboot directory, so I can make sure environment is clean.


Thanks,
Alex

If you remove the /var/lib/tftpboot directory and yum reinstall tftp-server
rpm should create the directory with the correct context.  I am not sure how you got this mislabeled unless you did a rm -rf /var/lib/tftpboot and a mkdir /var/lib/tftpboot, which would cause it to be mislabeled.

You should not need to run restorecon unless you created the directory by hand.

(In reply to comment #8)
> If you remove the /var/lib/tftpboot directory and yum reinstall tftp-server
> rpm should create the directory with the correct context.  I am not sure how
> you got this mislabeled unless you did a rm -rf /var/lib/tftpboot and a mkdir
> /var/lib/tftpboot, which would cause it to be mislabeled.
> 
> You should not need to run restorecon unless you created the directory by hand.

Hi Daniel,
Thanks for you comment, I am using a automate test script to run pxe installation,
as you said, the script is using mkdir to create /var/lib/tftpboot again(in fact, the directory has existed by installing tftp-server package), so it should be a root reason of the issue. I will check it again.

Alex

Just add restorecon to the test script after you create it and everything should work fine.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html