Bug 1182760 - pulp-celery optional puppet SELinux policy doesn't have enough permissions for symlinks
Summary: pulp-celery optional puppet SELinux policy doesn't have enough permissions fo...
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Pulp
Classification: Retired
Component: z_other
Version: Master
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: 2.6.1
Assignee: Dennis Kliban
QA Contact: pulp-qe-list
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-15 20:26 UTC by Dennis Kliban
Modified: 2015-02-28 23:19 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-02-28 23:19:29 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Pulp Redmine 663 0 None None None Never

Description Dennis Kliban 2015-01-15 20:26:38 UTC
Description of problem:

https://github.com/pulp/pulp/blob/master/server/selinux/server/pulp-celery.te#L105

On the above line, only the ability to create symlinks is provided.  It's probably necessary to add 'read getattr unlink' 

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Dennis Kliban 2015-02-16 15:59:20 UTC
The steps to reproduce this are the following:

1. Download the example puppet module that contains a symlink

wget https://repos.fedorapeople.org/repos/pulp/pulp/demo_repos/puppet_symlink/examplecorp-mymodule-0.1.0.tar.gz

2. Create directory to publish to 

sudo mkdir -p /etc/puppet/myforges/fakeforge
sudo chown -R apache:apache /etc/puppet/myforges

3. Create repo
pulp-admin puppet repo create --repo-id=fakeforge

4. Upload the example module

pulp-admin puppet repo uploads upload --file examplecorp-mymodule-0.1.0.tar.gz --repo-id fakeforge

5. Run the following script:

from pulp.common import pic

pic.connect()
pic.POST('/v2/repositories/fakeforge/distributors/', {'distributor_type_id':'puppet_install_distributor', 'distributor_id':'puppet_tmp_install_distributor', 'auto_publish': False, 'distributor_config': {'install_path':'/etc/puppet/myforges/fakeforge'}})

pic.connect()
pic.POST('/pulp/api/v2/repositories/fakeforge/actions/publish/', {'id': "puppet_tmp_install_distributor"})

6. Run the above script again.  

The second time you run this script it fails cause it can't remove a symlink due to an SELinux permission problem.

Comment 2 Dennis Kliban 2015-02-16 19:56:41 UTC
https://github.com/pulp/pulp/pull/1647

Comment 3 Dennis Kliban 2015-02-16 20:16:23 UTC
I have also updated documentation for configuring pulp_puppet 

https://github.com/pulp/pulp_puppet/pull/163/

Comment 4 Dennis Kliban 2015-02-17 14:01:16 UTC
Updated the PR to be against 2.6-dev

https://github.com/pulp/pulp/pull/1648
https://github.com/pulp/pulp_puppet/pull/164/

Comment 5 Brian Bouterse 2015-02-28 23:19:29 UTC
Moved to https://pulp.plan.io/issues/663


Note You need to log in before you can comment on or make changes to this bug.