Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1078265 - katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket
Summary: katello-installer generates AVC: denied { name_connect } for scontext=passeng...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: SELinux
Version: Nightly
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: Unspecified
Assignee: Lukas Zapletal
QA Contact: Jan Hutař
URL: http://projects.theforeman.org/issues...
Whiteboard:
: 1104270 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-03-19 13:57 UTC by Jan Hutař
Modified: 2019-09-25 21:23 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-09-11 12:22:01 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 5827 0 None None None 2016-04-22 15:07:45 UTC

Description Jan Hutař 2014-03-19 13:57:32 UTC 
Description of problem:
katello-installer generates AVCs


Version-Release number of selected component (if applicable):
Satellite-6.0.3-RHEL-6-20140318.3


How reproducible:
always


Steps to Reproduce:
1. # katello-installer
2. # katello-installer --capsule-parent-fqdn <fqdn> --capsule-dns true --capsule-dns-forwarders 10.16.36.29 --capsule-dns-forwarders 10.11.5.19 --capsule-dns-forwarders 10.5.30.160 --capsule-dns-interface eth0 --capsule-dns-zone katellolabs.org --capsule-dhcp true --capsule-dhcp-interface eth0 --capsule-tftp true --capsule-puppet true --capsule-puppetca true --capsule-register-in-foreman true --capsule-foreman-oauth-secret <secret> --capsule-pulp false


Actual results:
=== katello-installer ===
SELinux: 2048 avtab hash slots, 278892 rules.
SELinux: 2048 avtab hash slots, 278892 rules.
SELinux:  9 users, 12 roles, 3937 types, 220 bools, 1 sens, 1024 cats
SELinux:  81 classes, 278892 rules

=== katello-installer --capsule-parent-fqdn <fqdn> --capsule-dns true --capsule-dns-forwarders 10.16.36.29 --capsule-dns-forwarders 10.11.5.19 --capsule-dns-forwarders 10.5.30.160 --capsule-dns-interface eth0 --capsule-dns-zone katellolabs.org --capsule-dhcp true --capsule-dhcp-interface eth0 --capsule-tftp true --capsule-puppet true --capsule-puppetca true --capsule-register-in-foreman true --capsule-foreman-oauth-secret <secret> --capsule-pulp false ===
time->Sun Mar 16 17:17:03 2014
type=SYSCALL msg=audit(1395004623.756:191): arch=c000003e syscall=42 success=no exit=-111 a0=f a1=7f5cc05faf00 a2=1c a3=ff00 items=0 ppid=23315 pid=23863 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1395004623.756:191): avc:  denied  { name_connect } for  pid=23863 comm="ruby" dest=9090 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
Fail: AVC messages found.


Expected results:
No AVCs should be generated


Additional info:
This is most probably a known issue, but filling it as I have not seen it anywhere.
Comment 1 RHEL Program Management 2014-03-19 14:15:14 UTC 
Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.
Comment 3 Dominic Cleal 2014-05-20 15:20:51 UTC 
Created redmine issue http://projects.theforeman.org/issues/5827 from this bug
Comment 4 Bryan Kearney 2014-05-23 15:46:43 UTC 
Upstream bug assigned to lzap
Comment 5 Lukas Zapletal 2014-05-26 13:59:02 UTC 
Fixed upstream, PR pending review.
Comment 7 Bryan Kearney 2014-06-02 12:06:20 UTC 
Moving to POST since upstream bug http://projects.theforeman.org/issues/5827 has been closed
Comment 9 Corey Welton 2014-06-20 15:44:30 UTC 
Seeing this in latest build Satellite-6.0.3-RHEL-6-20140619.0.  Still related to installer?

type=AVC msg=audit(1403208049.892:2114): avc:  denied  { name_connect } for  pid=18332 comm="ruby" dest=9200 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1403208049.892:2114): arch=c000003e syscall=42 success=no exit=-111 a0=f a1=7f063cdbc050 a2=1c a3=ff00 items=0 ppid=1 pid=18332 auid=0 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=19 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)

reopening for consideration.
Comment 10 Jan Hutař 2014-06-24 10:32:49 UTC 
I have reported bug 1112607 as well (includes this and 4 other AVCs generated by katello-installer).
Comment 11 Lukas Zapletal 2014-06-24 15:13:18 UTC 
The package did not contain my patch.

Jason please make sure you rebase foreman-selinux from latest develop upstream branch. Thanks.
Comment 12 Lukas Zapletal 2014-06-25 10:20:21 UTC 
*** Bug 1104270 has been marked as a duplicate of this bug. ***
Comment 17 Bryan Kearney 2014-09-11 12:22:01 UTC 
This was delivered with Satellite 6.0 which was released on 10 September 2014.
Comment 21 Dave Sullivan 2014-12-26 20:04:14 UTC 
https://bugzilla.redhat.com/show_bug.cgi?id=1177377
Note You need to log in before you can comment on or make changes to this bug.