Bug 799131
| Summary: | SELinux prevents embedded Oracle operations on RHEL6.2 | ||
|---|---|---|---|
| Product: | Red Hat Satellite 5 | Reporter: | Will Saxon <will.saxon> |
| Component: | Upgrades | Assignee: | Milan Zázrivec <mzazrivec> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Martin Korbel <mkorbel> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 541 | CC: | cperry, mkorbel, mminar |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | oracle-rhnsat-selinux-10.2.0.20-3 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-09-28 13:49:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 819024, 819025 | ||
|
Description
Will Saxon
2012-03-01 20:34:49 UTC
Please contact Red Hat support to help you with the Satellite upgrade issues you are experiencing and whether or not those issues are valid bug(s) in RHN Satellite product. Has this issue been escalated to Red Hat support and / or resolved successfully? Thank you -Milan Zázrivec I did not escalate this to support. We created a module w/ audit2allow and moved on. The problem manifested every time I set up a new instance of RHEL6.2 and tried to install Satellite, so it should not be difficult to reproduce. All right, what did the denials (those showing during spacewalk-schema-upgrade) look like exactly? I'll see if I can reproduce it again. Alternatively, you can paste the source of the new SELinux modules here.
module RHNSatellite 1.0;
require {
type oracle_common_log_t;
type oracle_db_t;
class file read;
}
#============= oracle_db_t ==============
allow oracle_db_t oracle_common_log_t:file read;
On the Satellite 5.2.1 installation -- has auditing been enabled in the embedded Oracle database? I have no idea - we don't have the 5.2.1 installation anymore to check against, either. As far as 5.4.1 goes, everything is default as far as I know. We really just tried to follow the upgrade instructions included w/ Satellite, to the letter. You can find out for example by running the following command as root: # rhn-db-stats - |grep audit (In reply to comment #10) > You can find out for example by running the following command as root: > > # rhn-db-stats - |grep audit Forgot to mention -- this should be run on the 5.4 Satellite. audit_file_dest string /rhnsat/admin/rhnsat/logs audit_sys_operations boolean FALSE audit_syslog_level string audit_trail string NONE We were able to reproduce the problem described in the initial comment during upgrades; the fix (updated SELinux policy) will be available in Satellite 5.5. Thank you for your report & sorry for the trouble. Fixed in spacewalk.git master: 025063c2dbef237ed89166f64735da1897856419 |