Fedora Account System
Red Hat Associate
Red Hat Customer
Fedora is moving to a new version of RT, and the existing policy bits aren't particularly well-suited to the newer version. Basically, RT is a web application and needs to write to /var/cache/rt, /var/lib/rt and /var/log/rt. The current policy has: /var/cache/rt(3|4)(/.*)? all files system_u:object_r:httpd_cache_t:s0 /var/lib/rt(3|4)/data/RT-Shredder(/.*)? all files system_u:object_r:httpd_var_lib_t:s0 I guess changing those paths to /var/cache/rt(3|4)?(/.*)? and /var/lib/rt(3|4)?(/.*)? would help but I'm not sure about the type for /var/log/rt. Maybe httpd_log_t?
*** Bug 1239198 has been marked as a duplicate of this bug. ***
An end user reported the following AVC in the ticket I just closed as a duplicate: type=AVC msg=audit(1435994355.726:771): avc: denied { getattr } for pid=6386 comm="/usr/sbin/rt-se" path="/var/cache/rt/mason_data/obj/.__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0 type=AVC msg=audit(1435994355.726:772): avc: denied { write } for pid=6386 comm="/usr/sbin/rt-se" name=".__obj_create_marker" dev="vda2" ino=662318 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0 which should give enough info to at least fix the incorrect /var/cache/rt pattern.
Here's another one while trying to configure it. SELinux is preventing /usr/sbin/httpd from write access on the file RT_SiteConfig.pm. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow httpd to have write access on the RT_SiteConfig.pm file Then you need to change the label on RT_SiteConfig.pm Do # semanage fcontext -a -t FILE_TYPE 'RT_SiteConfig.pm' where FILE_TYPE is one of the following: abrt_retrace_spool_t, afs_cache_t, anon_inodefs_t, apcupsd_cgi_rw_content_t, awstats_rw_content_t, bugzilla_rw_content_t, collectd_rw_content_t, cvs_rw_content_t, dirsrv_config_t, dirsrv_var_log_t, dirsrv_var_run_t, dirsrvadmin_config_t, dirsrvadmin_rw_content_t, dirsrvadmin_tmp_t, dspam_rw_content_t, git_rw_content_t, httpd_cache_t, httpd_lock_t, httpd_squirrelmail_t, httpd_sys_rw_content_t, httpd_tmp_t, httpd_tmpfs_t, httpd_user_rw_content_t, httpd_var_lib_t, httpd_var_run_t, initrc_tmp_t, jetty_cache_t, jetty_log_t, jetty_var_lib_t, jetty_var_run_t, keystone_cgi_rw_content_t, krb5_host_rcache_t, man2html_rw_content_t, mediawiki_rw_content_t, mirrormanager_var_run_t, mojomojo_rw_content_t, munin_rw_content_t, mythtv_rw_content_t, nagios_rw_content_t, nutups_cgi_rw_content_t, openshift_rw_content_t, passenger_tmp_t, passenger_var_run_t, pki_ra_etc_rw_t, pki_ra_log_t, pki_ra_var_lib_t, pki_tps_etc_rw_t, pki_tps_log_t, pki_tps_var_lib_t, postfix_spool_maildrop_t, prewikka_rw_content_t, puppet_tmp_t, security_t, smokeping_cgi_rw_content_t, squid_rw_content_t, squirrelmail_spool_t, systemd_passwd_var_run_t, user_cron_spool_t, w3c_validator_rw_content_t, webalizer_rw_content_t, zarafa_var_lib_t, zoneminder_rw_content_t, zoneminder_var_lib_t. Then execute: restorecon -v 'RT_SiteConfig.pm' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that httpd should be allowed write access on the RT_SiteConfig.pm file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep /usr/sbin/httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:etc_t:s0 Target Objects RT_SiteConfig.pm [ file ] Source /usr/sbin/httpd Source Path /usr/sbin/httpd Port <Unknown> Host localhost.localdomain Source RPM Packages httpd-2.4.6-31.el7.centos.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-23.el7_1.8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 3.10.0-229.7.2.el7.x86_64 #1 SMP Tue Jun 23 22:06:11 UTC 2015 x86_64 x86_64 Alert Count 1 First Seen 2015-07-23 13:24:53 PDT Last Seen 2015-07-23 13:24:53 PDT Local ID a78efbfc-0381-4ddb-b17b-f156602f83d0 Raw Audit Messages type=AVC msg=audit(1437683093.679:167): avc: denied { write } for pid=3273 comm="/usr/sbin/httpd" name="RT_SiteConfig.pm" dev="vda2" ino=163061 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file type=SYSCALL msg=audit(1437683093.679:167): arch=x86_64 syscall=open success=no exit=EACCES a0=7fd10f77e260 a1=241 a2=1b6 a3=0 items=0 ppid=3268 pid=3273 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=/usr/sbin/httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null) Hash: /usr/sbin/httpd,httpd_t,etc_t,file,write
Where is RT_SiteConfig.pm located in /etc?
/etc/rt Interestingly, I did not get this error when setting it up on Fedora 21. I only got it on RHEL 7.1. Here are the customizations I ended up using: fcontext -a -f a -t httpd_cache_t '/var/cache/rt(/.*)?' fcontext -a -f a -t httpd_var_lib_t '/var/lib/rt(/.*)?' fcontext -a -f a -t httpd_log_t '/var/log/rt(/.*)?' I'm reasonably confident those are solid. I just finished installing the RT web site (not the mailgate) on a production system. In the next few weeks, I should have a pretty good idea if there's any breakage.
Looks like /etc/rt needs a label like httpd_sys_content_rw_t
commit 432543034a05accafe43bb372e74f347e262115a Author: Lukas Vrabec <lvrabec> Date: Tue Jul 28 15:14:03 2015 +0200 Label /etc/rt dir as httpd_sys_rw_content_t BZ(#1185500)
selinux-policy-3.13.1-140.fc23 has been submitted as an update for Fedora 23. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-140.fc23
selinux-policy-3.13.1-140.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.