Hide Forgot
Created attachment 834391 [details] audit log filtered for qpidd denials Version-Release number of selected component (if applicable): pulp-2.3 How reproducible: Always Steps to Reproduce: follow https://pulp-user-guide.readthedocs.org/en/pulp-2.3/qpid.html#qpid-ssl-configuration Actual results: blocked qpidd openssl config Expected results: Additional info: # see AVC denials in attached log file
# Investigating the avc details, following are affected files: [root@ec2-54-216-182-120 ~]# inums=( `grep -i avc /var/log/audit/audit.log | grep qpidd | sed -e 's,.*ino=\([^\s]*\).*,\1,' | sort | uniq` ) [root@ec2-54-216-182-120 ~]# for inum in ${inums[@]} ; do find / -inum $inum -exec ls -lZd {} \; ; done -rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/group drwxr-xr-x. apache apache system_u:object_r:pulp_cert_t:s0 /etc/pki/pulp drwxr-xr-x. root root unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid -rw-r-----. root qpidd unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid/nss/secmod.db -rw-r-----. root qpidd unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid/nss/password -rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/passwd
Update documentation to run selinux commands to update file contexts for the certs.
Moved to https://pulp.plan.io/issues/388