-E     Ignore  environment  variables like PYTHONPATH and PYTHONHOME that modify the
              behavior of the interpreter.

-s     Don't add user site directory to sys.path.

Some notes before I forget: Issue seems to originate from having a PYTHONPATH or PYTHONHOME set (or other mechanisms that add paths to the pythonpath), so /usr/bin/python[2.7] ends up attempting to read files from those paths as part of it's module discovery, but the selinux policy for rhsmcertd does not allow that, causing the AVC denials.

The suggestion for '-E' and '-s' for rhsmcertd-worker.py should work. Could also attempt to scrub python path altering env vars from rhsmcertd's env before/while invoking rhsmcertd-worker, but I suspect '-E -s' will cover more cases.

pr at https://github.com/candlepin/subscription-manager/pull/1221

commit 7c066d0a155c122f451f1a3a255b9140e02ae894
Author: Adrian Likins <alikins>
Date:   Thu Jul 9 14:59:47 2015 -0400

    1136163: Ignore pythonpath to avoid selinux AVCs
    
    For rhsmcertd-worker.py in particular, since it runs
    as a child of rhsmcertd, which has very restrictive
    selinux policy by default.
    
    Because of either PYTHONPATH env var or system/site/user
    changes to the pythonpath, rhsmcertd-worker.py could
    end up attempting to find and open modules in path
    that the selinux policy prevents it from accessing.
    
    If the path ended up including '.', it would attempt
    to read from cwd and cause denials.
    
    So specify the '-E' and '-s' args to /usr/bin/python
    -E     : ignore PYTHON* environment variables (such as PYTHONPATH)
    -s     : don't add user site directory to sys.path; also
             PYTHONNOUSERSITE

I tried to replicate the problem with the following:

1) I took out the -Es change in rhsmcertd-worker.py
2) I tried

Accidentally hit save too soon :)

2) I did:  export PYTHONPATH="."
3) from /usr directory ran:  systemctl restart rhsmcertd

And nothing happened. I am not sure what directory root will be prevented having read access by selinux.  Alternatively, if I use a non-root user, how can I start rhsmcertd without an effective UID of root?

The fix from comment 6 is available in subscription-manager-1.15.8-1 or newer.

NEEDINFO from reporter as we not been able to reproduce the original error.
Please confirm that upgrading to subscription-manager-1.15.8-1 or newer resolves the AVC denial.

We have tried to reproduce the problem but without any success.  also, the reporter of the problem has also not been working with subscription manager and was unable to reproduce it as well.

We have tested the -Es args passed to the python process argument which was the purported fix for the problem, and it does not seem to cause any other undue effects.

If the problem re-occurs, we can reopen this bug.

Yes with subscription-manager-gui-1.15.9-7.el7.x86_64 and subscription-manager-1.15.9-7.el7.x86_64 I can work without making SELinux angry. And it is always a way faster.

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days