Bug 1483748 - restorecon on /httpboot on director causes selinux errors
Summary: restorecon on /httpboot on director causes selinux errors
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-selinux
Version: 11.0 (Ocata)
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: z4
: 11.0 (Ocata)
Assignee: Ilya Etingof
QA Contact: mlammon
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-08-21 20:53 UTC by david.costakos
Modified: 2018-10-09 22:45 UTC (History)
12 users (show)

Fixed In Version: openstack-selinux-0.8.11-1.el7ost
Doc Type: Bug Fix
Doc Text:
Incorrect SELinux fcontext for '/httpboot' and '/tftpboot' directories on the director caused access errors during PXE boot. This fix adds the correct fcontext for these directories. Nodes now PXE boot from the director without access errors.
Clone Of:
Environment:
Last Closed: 2018-02-13 16:38:01 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3645552 None None None 2018-10-09 22:45:29 UTC
Red Hat Product Errata RHBA-2018:0311 normal SHIPPED_LIVE Red Hat OpenStack Platform 11 Bug Fix and Enhancement Advisory 2018-02-14 00:05:57 UTC

Description david.costakos 2017-08-21 20:53:26 UTC
Description of problem:
Before a restorecon on /httpboot, selinux labels look like this:
# ls -laZ /httpboot/
drwxr-xr-x. ironic           ironic           system_u:object_r:httpd_sys_content_t:s0 .
dr-xr-xr-x. root             root             system_u:object_r:root_t:s0      ..
drwxr-xr-x. ironic           ironic           system_u:object_r:httpd_sys_content_t:s0 026d40fa-9f31-42b4-bc0b-4560f7df061c
-rwxr-xr-x. root             root             unconfined_u:object_r:httpd_sys_content_t:s0 agent.kernel
-rw-r--r--. root             root             unconfined_u:object_r:httpd_sys_content_t:s0 agent.ramdisk
-rw-r--r--. root             root             unconfined_u:object_r:httpd_sys_content_t:s0 agent.ramdisk.20170811.original
-rw-r--r--. ironic           ironic           system_u:object_r:httpd_sys_content_t:s0 boot.ipxe
-rw-r--r--. ironic-inspector ironic-inspector system_u:object_r:httpd_sys_content_t:s0 inspector.ipxe
drwxr-xr-x. ironic           ironic           system_u:object_r:httpd_sys_content_t:s0 pxelinux.cfg

After a restorecon, they get changed causing downloads of inspector.ipxe and the boot ipxe roms to fail:
# restorecon -rv /httpboot/
restorecon reset /httpboot context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/inspector.ipxe context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/agent.kernel context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:default_t:s0
restorecon reset /httpboot/agent.ramdisk context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:default_t:s0
restorecon reset /httpboot/boot.ipxe context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/pxelinux.cfg context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/pxelinux.cfg/00-0e-1e-aa-df-90 context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/026d40fa-9f31-42b4-bc0b-4560f7df061c context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/026d40fa-9f31-42b4-bc0b-4560f7df061c/config context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/026d40fa-9f31-42b4-bc0b-4560f7df061c/deploy_ramdisk context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/026d40fa-9f31-42b4-bc0b-4560f7df061c/deploy_kernel context system_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /httpboot/agent.ramdisk.20170811.original context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:default_t:s0

# ls -laZ /httpboot/
drwxr-xr-x. ironic           ironic           system_u:object_r:default_t:s0   .
dr-xr-xr-x. root             root             system_u:object_r:root_t:s0      ..
drwxr-xr-x. ironic           ironic           system_u:object_r:default_t:s0   026d40fa-9f31-42b4-bc0b-4560f7df061c
-rwxr-xr-x. root             root             unconfined_u:object_r:default_t:s0 agent.kernel
-rw-r--r--. root             root             unconfined_u:object_r:default_t:s0 agent.ramdisk
-rw-r--r--. root             root             unconfined_u:object_r:default_t:s0 agent.ramdisk.20170811.original
-rw-r--r--. ironic           ironic           system_u:object_r:default_t:s0   boot.ipxe
-rw-r--r--. ironic-inspector ironic-inspector system_u:object_r:default_t:s0   inspector.ipxe
drwxr-xr-x. ironic           ironic           system_u:object_r:default_t:s0   pxelinux.cfg

this causes downloads of ipxe roms to fail: i.e:
wget -O /dev/null http://10.9.70.4:8088/inspector.ipxe
--2017-08-21 16:47:55--  http://10.9.70.4:8088/inspector.ipxe
Connecting to 10.9.70.4:8088... connected.
HTTP request sent, awaiting response... 403 Forbidden
2017-08-21 16:47:55 ERROR 403: Forbidden.

SELinux is preventing /usr/sbin/httpd from getattr access on the file /httpboot/inspector.ipxe.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow httpd to have getattr access on the inspector.ipxe file
Then you need to change the label on /httpboot/inspector.ipxe
Do
# semanage fcontext -a -t FILE_TYPE '/httpboot/inspector.ipxe'
where FILE_TYPE is one of the following: NetworkManager_exec_t, NetworkManager_log_t, NetworkManager_tmp_t, abrt_dump_oops_exec_t, abrt_etc_t, abrt_exec_t, abrt_handle_event_exec_t, abrt_helper_exec_t, abrt_retrace_coredump_exec_t, abrt_retrace_spool_t, abrt_retrace_worker_exec_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, accountsd_exec_t, acct_data_t, acct_exec_t, admin_crontab_tmp_t, admin_passwd_exec_t, afs_logfile_t, aide_exec_t, aide_log_t, alsa_exec_t, alsa_tmp_t, amanda_exec_t, amanda_log_t, amanda_recover_exec_t, amanda_tmp_t, amtu_exec_t, anacron_exec_t, anon_inodefs_t, antivirus_exec_t, antivirus_log_t, antivirus_tmp_t, apcupsd_cgi_content_t, apcupsd_cgi_htaccess_t, apcupsd_cgi_ra_content_t, apcupsd_cgi_rw_content_t, apcupsd_cgi_script_exec_t, apcupsd_log_t, apcupsd_tmp_t, apm_exec_t, apmd_log_t, apmd_tmp_t, arpwatch_tmp_t, asterisk_log_t, asterisk_tmp_t, audisp_exec_t, auditadm_sudo_tmp_t, auditctl_exec_t, auth_cache_t, authconfig_exec_t, automount_tmp_t, avahi_exec_t, awstats_content_t, awstats_htaccess_t, awstats_ra_content_t, awstats_rw_content_t, awstats_script_exec_t, awstats_tmp_t, bacula_admin_exec_t, bacula_log_t, bacula_tmp_t, bacula_unconfined_script_exec_t, bin_t, bitlbee_log_t, bitlbee_tmp_t, blueman_exec_t, bluetooth_helper_exec_t, bluetooth_helper_tmp_t, bluetooth_helper_tmpfs_t, bluetooth_tmp_t, boinc_log_t, boinc_project_tmp_t, boinc_tmp_t, boot_t, bootloader_exec_t, bootloader_tmp_t, brctl_exec_t, brltty_log_t, bugzilla_content_t, bugzilla_htaccess_t, bugzilla_ra_content_t, bugzilla_rw_content_t, bugzilla_script_exec_t, bugzilla_tmp_t, calamaris_exec_t, calamaris_log_t, calamaris_www_t, callweaver_log_t, canna_log_t, cardctl_exec_t, cardmgr_dev_t, ccs_tmp_t, ccs_var_lib_t, ccs_var_log_t, cdcc_exec_t, cdcc_tmp_t, cdrecord_exec_t, cert_t, certmaster_var_log_t, certmonger_unconfined_exec_t, certwatch_exec_t, cfengine_log_t, cgred_log_t, checkpc_exec_t, checkpc_log_t, checkpolicy_exec_t, chfn_exec_t, chkpwd_exec_t, chrome_sandbox_exec_t, chrome_sandbox_nacl_exec_t, chrome_sandbox_tmp_t, chronyd_var_log_t, cinder_api_tmp_t, cinder_backup_tmp_t, cinder_log_t, cinder_scheduler_tmp_t, cinder_volume_tmp_t, cloud_init_tmp_t, cloud_log_t, cluster_conf_t, cluster_tmp_t, cluster_var_lib_t, cluster_var_log_t, cluster_var_run_t, cobbler_etc_t, cobbler_tmp_t, cobbler_var_lib_t, cobbler_var_log_t, cockpit_tmp_t, collectd_content_t, collectd_htaccess_t, collectd_ra_content_t, collectd_rw_content_t, collectd_script_exec_t, collectd_script_tmp_t, colord_exec_t, colord_tmp_t, comsat_tmp_t, condor_log_t, condor_master_tmp_t, condor_schedd_tmp_t, condor_startd_tmp_t, conman_log_t, conman_tmp_t, conman_unconfined_script_exec_t, consolehelper_exec_t, consolekit_exec_t, consolekit_log_t, container_log_t, container_runtime_tmp_t, couchdb_log_t, couchdb_tmp_t, courier_exec_t, cpu_online_t, cpucontrol_exec_t, cpufreqselector_exec_t, cpuspeed_exec_t, crack_exec_t, crack_tmp_t, cron_log_t, crond_tmp_t, crontab_exec_t, crontab_tmp_t, ctdbd_log_t, ctdbd_tmp_t, cups_pdf_tmp_t, cupsd_config_exec_t, cupsd_log_t, cupsd_lpd_tmp_t, cupsd_tmp_t, cvs_content_t, cvs_data_t, cvs_exec_t, cvs_htaccess_t, cvs_ra_content_t, cvs_rw_content_t, cvs_script_exec_t, cvs_tmp_t, cyphesis_exec_t, cyphesis_log_t, cyphesis_tmp_t, cyrus_tmp_t, dbadm_sudo_tmp_t, dbskkd_tmp_t, dbusd_etc_t, dbusd_exec_t, dcc_client_exec_t, dcc_client_tmp_t, dcc_dbclean_exec_t, dcc_dbclean_tmp_t, dccd_tmp_t, dccifd_tmp_t, dccm_tmp_t, ddclient_log_t, ddclient_tmp_t, debuginfo_exec_t, deltacloudd_log_t, deltacloudd_tmp_t, denyhosts_var_log_t, depmod_exec_t, devicekit_disk_exec_t, devicekit_exec_t, devicekit_power_exec_t, devicekit_tmp_t, devicekit_var_log_t, dhcpc_exec_t, dhcpc_tmp_t, dhcpd_tmp_t, dirsrv_config_t, dirsrv_share_t, dirsrv_snmp_var_log_t, dirsrv_tmp_t, dirsrv_var_log_t, dirsrv_var_run_t, dirsrvadmin_config_t, dirsrvadmin_content_t, dirsrvadmin_htaccess_t, dirsrvadmin_ra_content_t, dirsrvadmin_rw_content_t, dirsrvadmin_script_exec_t, dirsrvadmin_tmp_t, dirsrvadmin_unconfined_script_exec_t, disk_munin_plugin_exec_t, disk_munin_plugin_tmp_t, dkim_milter_tmp_t, dlm_controld_var_log_t, dmesg_exec_t, dmidecode_exec_t, dnsmasq_var_log_t, dnssec_trigger_tmp_t, dovecot_auth_tmp_t, dovecot_deliver_tmp_t, dovecot_tmp_t, dovecot_var_log_t, drbd_tmp_t, dspam_content_t, dspam_htaccess_t, dspam_log_t, dspam_ra_content_t, dspam_rw_content_t, dspam_script_exec_t, etc_runtime_t, etc_t, evtchnd_var_log_t, exim_exec_t, exim_log_t, exim_tmp_t, fail2ban_client_exec_t, fail2ban_log_t, fail2ban_tmp_t, fail2ban_var_lib_t, faillog_t, fenced_tmp_t, fenced_var_log_t, fetchmail_exec_t, fetchmail_log_t, file_context_t, fingerd_log_t, firewalld_exec_t, firewalld_tmp_t, firewalld_var_log_t, firewallgui_exec_t, firewallgui_tmp_t, firstboot_exec_t, foghorn_var_log_t, fonts_cache_t, fonts_t, fprintd_exec_t, freqset_exec_t, fsadm_exec_t, fsadm_log_t, fsadm_tmp_t, fsdaemon_tmp_t, ftpd_tmp_t, ftpdctl_exec_t, ftpdctl_tmp_t, games_exec_t, games_tmp_t, games_tmpfs_t, ganesha_tmp_t, ganesha_var_log_t, gconf_tmp_t, gconfd_exec_t, gconfdefaultsm_exec_t, geoclue_exec_t, geoclue_tmp_t, getty_exec_t, getty_log_t, getty_tmp_t, gfs_controld_var_log_t, git_content_t, git_htaccess_t, git_ra_content_t, git_rw_content_t, git_script_exec_t, git_script_tmp_t, git_sys_content_t, gitd_exec_t, gitosis_exec_t, gitosis_var_lib_t, gkeyringd_exec_t, gkeyringd_tmp_t, glance_log_t, glance_registry_tmp_t, glance_tmp_t, glusterd_log_t, glusterd_tmp_t, gnomesystemmm_exec_t, gpg_agent_exec_t, gpg_agent_tmp_t, gpg_exec_t, gpg_helper_exec_t, gpg_pinentry_tmp_t, gpg_pinentry_tmpfs_t, gpm_tmp_t, gpsd_exec_t, groupadd_exec_t, groupd_var_log_t, gssd_tmp_t, haproxy_var_log_t, hostname_etc_t, hostname_exec_t, hsqldb_tmp_t, httpd_cache_t, httpd_config_t, httpd_exec_t, httpd_helper_exec_t, httpd_keytab_t, httpd_lock_t, httpd_log_t, httpd_modules_t, httpd_passwd_exec_t, httpd_php_exec_t, httpd_php_tmp_t, httpd_rotatelogs_exec_t, httpd_squirrelmail_t, httpd_suexec_exec_t, httpd_suexec_tmp_t, httpd_sys_content_t, httpd_sys_htaccess_t, httpd_sys_ra_content_t, httpd_sys_rw_content_t, httpd_sys_script_exec_t, httpd_tmp_t, httpd_tmpfs_t, httpd_unconfined_script_exec_t, httpd_user_htaccess_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t, httpd_var_lib_t, httpd_var_run_t, hugetlbfs_t, hwclock_exec_t, hwloc_dhwd_exec_t, iceauth_exec_t, icecast_exec_t, icecast_log_t, ifconfig_exec_t, inetd_child_tmp_t, inetd_log_t, inetd_tmp_t, init_tmp_t, initrc_tmp_t, initrc_var_log_t, innd_log_t, insmod_exec_t, install_exec_t, iotop_exec_t, ipa_cert_t, ipa_helper_exec_t, ipa_log_t, ipa_tmp_t, ipa_var_lib_t, ipa_var_run_t, ipsec_log_t, ipsec_mgmt_exec_t, ipsec_tmp_t, iptables_exec_t, iptables_tmp_t, irc_exec_t, irssi_exec_t, iscsi_log_t, iscsi_tmp_t, iso9660_t, iwhd_log_t, jetty_cache_t, jetty_log_t, jetty_var_lib_t, jetty_var_run_t, jockey_exec_t, jockey_var_log_t, journalctl_exec_t, kadmind_log_t, kadmind_tmp_t, kdump_exec_t, kdumpctl_tmp_t, kdumpgui_exec_t, kdumpgui_tmp_t, keepalived_unconfined_script_exec_t, keystone_cgi_content_t, keystone_cgi_htaccess_t, keystone_cgi_ra_content_t, keystone_cgi_rw_content_t, keystone_cgi_script_exec_t, keystone_log_t, keystone_tmp_t, kismet_exec_t, kismet_log_t, kismet_tmp_t, kismet_tmpfs_t, klogd_tmp_t, krb5_conf_t, krb5_host_rcache_t, krb5_keytab_t, krb5kdc_conf_t, krb5kdc_log_t, krb5kdc_tmp_t, ksmtuned_log_t, ktalkd_log_t, ktalkd_tmp_t, l2tpd_tmp_t, lastlog_t, ld_so_cache_t, ld_so_t, ldconfig_exec_t, ldconfig_tmp_t, lib_t, livecd_exec_t, livecd_tmp_t, load_policy_exec_t, loadkeys_exec_t, locale_t, locate_exec_t, lockdev_exec_t, login_exec_t, logrotate_mail_tmp_t, logrotate_tmp_t, logwatch_exec_t, logwatch_mail_tmp_t, logwatch_tmp_t, lpd_tmp_t, lpr_exec_t, lpr_tmp_t, lsassd_tmp_t, lsmd_plugin_exec_t, lsmd_plugin_tmp_t, lvm_exec_t, lvm_tmp_t, machineid_t, mail_munin_plugin_exec_t, mail_munin_plugin_tmp_t, mailman_archive_t, mailman_cgi_exec_t, mailman_cgi_tmp_t, mailman_data_t, mailman_log_t, mailman_mail_tmp_t, mailman_queue_tmp_t, man2html_content_t, man2html_htaccess_t, man2html_ra_content_t, man2html_rw_content_t, man2html_script_exec_t, man_cache_t, man_t, mandb_cache_t, mcelog_exec_t, mcelog_log_t, mdadm_log_t, mdadm_tmp_t, mediawiki_content_t, mediawiki_htaccess_t, mediawiki_ra_content_t, mediawiki_rw_content_t, mediawiki_script_exec_t, mediawiki_tmp_t, mencoder_exec_t, minidlna_log_t, mirrormanager_exec_t, mirrormanager_log_t, mirrormanager_var_lib_t, mirrormanager_var_run_t, mock_build_exec_t, mock_exec_t, mock_tmp_t, modemmanager_exec_t, mojomojo_content_t, mojomojo_htaccess_t, mojomojo_ra_content_t, mojomojo_rw_content_t, mojomojo_script_exec_t, mojomojo_tmp_t, mongod_log_t, mongod_tmp_t, motion_log_t, mount_ecryptfs_exec_t, mount_exec_t, mount_tmp_t, mozilla_exec_t, mozilla_plugin_config_exec_t, mozilla_plugin_exec_t, mozilla_plugin_tmp_t, mozilla_plugin_tmpfs_t, mozilla_tmp_t, mozilla_tmpfs_t, mpd_exec_t, mpd_log_t, mpd_tmp_t, mplayer_exec_t, mplayer_tmpfs_t, mrtg_exec_t, mrtg_log_t, mscan_tmp_t, munin_content_t, munin_etc_t, munin_htaccess_t, munin_log_t, munin_ra_content_t, munin_rw_content_t, munin_script_exec_t, munin_script_tmp_t, munin_tmp_t, mysqld_etc_t, mysqld_log_t, mysqld_tmp_t, mythtv_content_t, mythtv_htaccess_t, mythtv_ra_content_t, mythtv_rw_content_t, mythtv_script_exec_t, mythtv_var_log_t, nagios_admin_plugin_exec_t, nagios_checkdisk_plugin_exec_t, nagios_content_t, nagios_etc_t, nagios_eventhandler_plugin_exec_t, nagios_eventhandler_plugin_tmp_t, nagios_htaccess_t, nagios_log_t, nagios_mail_plugin_exec_t, nagios_openshift_plugin_exec_t, nagios_openshift_plugin_tmp_t, nagios_ra_content_t, nagios_rw_content_t, nagios_script_exec_t, nagios_services_plugin_exec_t, nagios_system_plugin_exec_t, nagios_system_plugin_tmp_t, nagios_tmp_t, nagios_unconfined_plugin_exec_t, nagios_var_lib_t, named_checkconf_exec_t, named_exec_t, named_log_t, named_tmp_t, namespace_init_exec_t, ncftool_exec_t, ndc_exec_t, net_conf_t, netlabel_mgmt_exec_t, netutils_exec_t, netutils_tmp_t, neutron_log_t, neutron_tmp_t, newrole_exec_t, nova_log_t, nova_tmp_t, nscd_log_t, nsd_log_t, nsd_tmp_t, ntop_tmp_t, ntpd_log_t, ntpd_tmp_t, ntpdate_exec_t, numad_var_log_t, nut_upsd_tmp_t, nut_upsdrvctl_tmp_t, nut_upsmon_tmp_t, nutups_cgi_content_t, nutups_cgi_htaccess_t, nutups_cgi_ra_content_t, nutups_cgi_rw_content_t, nutups_cgi_script_exec_t, nx_server_tmp_t, obex_exec_t, oddjob_mkhomedir_exec_t, opendnssec_tmp_t, openhpid_log_t, openshift_cgroup_read_exec_t, openshift_cgroup_read_tmp_t, openshift_content_t, openshift_cron_tmp_t, openshift_htaccess_t, openshift_initrc_tmp_t, openshift_log_t, openshift_net_read_exec_t, openshift_ra_content_t, openshift_rw_content_t, openshift_script_exec_t, openshift_tmp_t, openshift_var_lib_t, opensm_log_t, openvpn_status_t, openvpn_tmp_t, openvpn_var_log_t, openvswitch_log_t, openvswitch_tmp_t, openwsman_log_t, openwsman_tmp_t, oracleasm_tmp_t, osad_log_t, pads_exec_t, pam_console_exec_t, pam_timestamp_tmp_t, passenger_exec_t, passenger_log_t, passenger_tmp_t, passenger_var_lib_t, passenger_var_run_t, passwd_exec_t, passwd_file_t, pcp_log_t, pcp_tmp_t, pcscd_var_run_t, pegasus_openlmi_storage_tmp_t, pegasus_tmp_t, pinentry_exec_t, ping_exec_t, piranha_log_t, piranha_web_tmp_t, pkcs_slotd_log_t, pkcs_slotd_tmp_t, pki_ra_etc_rw_t, pki_ra_log_t, pki_ra_var_lib_t, pki_ra_var_run_t, pki_tomcat_cert_t, pki_tomcat_log_t, pki_tomcat_tmp_t, pki_tps_etc_rw_t, pki_tps_log_t, pki_tps_var_lib_t, pki_tps_var_run_t, plymouth_exec_t, plymouthd_var_log_t, podsleuth_exec_t, podsleuth_tmp_t, podsleuth_tmpfs_t, policykit_auth_exec_t, policykit_exec_t, policykit_grant_exec_t, policykit_resolve_exec_t, policykit_tmp_t, polipo_exec_t, polipo_log_t, portmap_helper_exec_t, portmap_tmp_t, postfix_bounce_tmp_t, postfix_cleanup_tmp_t, postfix_exec_t, postfix_local_tmp_t, postfix_map_exec_t, postfix_map_tmp_t, postfix_pickup_tmp_t, postfix_pipe_tmp_t, postfix_postdrop_exec_t, postfix_postdrop_t, postfix_postqueue_exec_t, postfix_qmgr_tmp_t, postfix_showq_exec_t, postfix_smtp_tmp_t, postfix_smtpd_tmp_t, postfix_virtual_tmp_t, postgresql_log_t, postgresql_tmp_t, pppd_exec_t, pppd_log_t, pppd_tmp_t, pptp_log_t, prelink_exec_t, prelink_log_t, prelink_tmp_t, prelude_lml_tmp_t, prelude_log_t, preupgrade_data_t, preupgrade_exec_t, prewikka_content_t, prewikka_htaccess_t, prewikka_ra_content_t, prewikka_rw_content_t, prewikka_script_exec_t, privoxy_log_t, proc_t, procmail_exec_t, procmail_log_t, procmail_tmp_t, prosody_log_t, prosody_tmp_t, psad_tmp_t, psad_var_log_t, ptchown_exec_t, public_content_rw_t, public_content_t, pulseaudio_exec_t, pulseaudio_tmpfs_t, puppet_log_t, puppet_tmp_t, puppet_var_lib_t, puppetca_exec_t, puppetmaster_tmp_t, pwauth_exec_t, pyicqt_log_t, qdiskd_var_log_t, qemu_exec_t, qmail_tcp_env_exec_t, qpidd_tmp_t, quota_exec_t, rabbitmq_var_log_t, racoon_tmp_t, radiusd_log_t, readahead_exec_t, realmd_exec_t, realmd_tmp_t, realmd_var_lib_t, redis_log_t, rhev_agentd_log_t, rhev_agentd_tmp_t, rhsmcertd_exec_t, rhsmcertd_log_t, rhsmcertd_tmp_t, ricci_modcluster_var_log_t, ricci_tmp_t, ricci_var_log_t, rkhunter_var_lib_t, rlogind_tmp_t, rpcbind_tmp_t, rpm_exec_t, rpm_log_t, rpm_script_tmp_t, rpm_tmp_t, rssh_chroot_helper_exec_t, rssh_exec_t, rsync_exec_t, rsync_log_t, rsync_tmp_t, rtas_errd_log_t, rtas_errd_tmp_t, rtkit_daemon_exec_t, run_init_exec_t, samba_etc_t, samba_log_t, samba_net_exec_t, samba_net_tmp_t, samba_var_t, sambagui_exec_t, sanlock_log_t, sblim_tmp_t, screen_exec_t, secadm_sudo_tmp_t, sectool_tmp_t, sectool_var_log_t, sectoolm_exec_t, security_t, selinux_munin_plugin_exec_t, selinux_munin_plugin_tmp_t, semanage_exec_t, semanage_tmp_t, sendmail_exec_t, sendmail_log_t, sendmail_tmp_t, sensord_log_t, services_munin_plugin_exec_t, services_munin_plugin_tmp_t, session_dbusd_tmp_t, setfiles_exec_t, setkey_exec_t, setroubleshoot_fixit_exec_t, setroubleshoot_var_log_t, setroubleshootd_exec_t, setsebool_exec_t, seunshare_exec_t, sge_job_exec_t, sge_shepherd_exec_t, sge_tmp_t, shell_exec_t, shorewall_log_t, shorewall_tmp_t, showmount_exec_t, slapd_cert_t, slapd_log_t, slapd_tmp_t, slpd_log_t, smbcontrol_exec_t, smbd_tmp_t, smokeping_cgi_content_t, smokeping_cgi_htaccess_t, smokeping_cgi_ra_content_t, smokeping_cgi_rw_content_t, smokeping_cgi_script_exec_t, smokeping_var_lib_t, smokeping_var_run_t, smoltclient_exec_t, smoltclient_tmp_t, smsd_log_t, smsd_tmp_t, snapperd_exec_t, snapperd_log_t, snmpd_log_t, snort_log_t, snort_tmp_t, sosreport_exec_t, sosreport_tmp_t, soundd_tmp_t, spamc_exec_t, spamc_tmp_t, spamd_log_t, spamd_tmp_t, spamd_update_exec_t, speech-dispatcher_exec_t, speech-dispatcher_log_t, speech-dispatcher_tmp_t, squid_content_t, squid_cron_exec_t, squid_htaccess_t, squid_log_t, squid_ra_content_t, squid_rw_content_t, squid_script_exec_t, squid_tmp_t, squirrelmail_spool_t, src_t, ssh_agent_exec_t, ssh_agent_tmp_t, ssh_exec_t, ssh_keygen_exec_t, ssh_keygen_tmp_t, ssh_keysign_exec_t, ssh_tmpfs_t, sssd_public_t, sssd_selinux_manager_exec_t, sssd_var_lib_t, sssd_var_log_t, staff_sudo_tmp_t, stapserver_log_t, stapserver_tmp_t, stunnel_log_t, stunnel_tmp_t, su_exec_t, sudo_exec_t, sulogin_exec_t, svc_multilog_exec_t, svc_run_exec_t, svc_start_exec_t, svirt_tmp_t, svnserve_tmp_t, swat_tmp_t, swift_tmp_t, sysadm_passwd_tmp_t, sysadm_sudo_tmp_t, sysfs_t, syslogd_tmp_t, sysstat_exec_t, sysstat_log_t, system_conf_t, system_cronjob_tmp_t, system_db_t, system_dbusd_tmp_t, system_dbusd_var_lib_t, system_mail_tmp_t, system_munin_plugin_exec_t, system_munin_plugin_tmp_t, systemd_passwd_var_run_t, tcpd_tmp_t, telepathy_gabble_exec_t, telepathy_gabble_tmp_t, telepathy_idle_exec_t, telepathy_idle_tmp_t, telepathy_logger_exec_t, telepathy_logger_tmp_t, telepathy_mission_control_exec_t, telepathy_mission_control_tmp_t, telepathy_msn_exec_t, telepathy_msn_tmp_t, telepathy_salut_exec_t, telepathy_salut_tmp_t, telepathy_sofiasip_exec_t, telepathy_sofiasip_tmp_t, telepathy_stream_engine_exec_t, telepathy_stream_engine_tmp_t, telepathy_sunshine_exec_t, telepathy_sunshine_tmp_t, telnetd_tmp_t, tetex_data_t, textrel_shlib_t, tftpdir_t, tgtd_tmp_t, thin_aeolus_configserver_log_t, thin_log_t, thumb_exec_t, thumb_tmp_t, tmp_t, tmpreaper_exec_t, tomcat_log_t, tomcat_tmp_t, tor_var_log_t, traceroute_exec_t, tuned_log_t, tuned_tmp_t, tvtime_exec_t, tvtime_tmp_t, tvtime_tmpfs_t, udev_tmp_t, udev_var_run_t, ulogd_var_log_t, uml_exec_t, uml_tmp_t, uml_tmpfs_t, unconfined_exec_t, unconfined_munin_plugin_exec_t, unconfined_munin_plugin_tmp_t, update_modules_exec_t, update_modules_tmp_t, updfstab_exec_t, usbmodules_exec_t, usbmuxd_exec_t, user_cron_spool_t, user_fonts_t, user_home_t, user_mail_tmp_t, user_tmp_t, useradd_exec_t, userhelper_exec_t, usernetctl_exec_t, usr_t, utempter_exec_t, uucpd_log_t, uucpd_tmp_t, uux_exec_t, var_lib_t, var_log_t, var_spool_t, var_yp_t, varnishd_tmp_t, varnishlog_log_t, vdagent_log_t, virsh_exec_t, virt_log_t, virt_qemu_ga_log_t, virt_qemu_ga_tmp_t, virt_qemu_ga_unconfined_exec_t, virt_tmp_t, virtd_lxc_exec_t, vlock_exec_t, vmtools_helper_exec_t, vmtools_tmp_t, vmware_exec_t, vmware_host_tmp_t, vmware_log_t, vmware_tmp_t, vmware_tmpfs_t, vnstat_exec_t, vpnc_exec_t, vpnc_tmp_t, w3c_validator_content_t, w3c_validator_htaccess_t, w3c_validator_ra_content_t, w3c_validator_rw_content_t, w3c_validator_script_exec_t, w3c_validator_tmp_t, watchdog_log_t, watchdog_unconfined_exec_t, webadm_tmp_t, webalizer_content_t, webalizer_exec_t, webalizer_htaccess_t, webalizer_ra_content_t, webalizer_rw_content_t, webalizer_script_exec_t, webalizer_tmp_t, winbind_log_t, wine_exec_t, wireshark_exec_t, wireshark_tmp_t, wireshark_tmpfs_t, wpa_cli_exec_t, wtmp_t, xauth_exec_t, xauth_tmp_t, xdm_exec_t, xdm_log_t, xdm_unconfined_exec_t, xend_tmp_t, xend_var_log_t, xenstored_tmp_t, xenstored_var_log_t, xferlog_t, xserver_exec_t, xserver_log_t, xserver_tmpfs_t, ypbind_tmp_t, ypserv_tmp_t, zabbix_log_t, zabbix_script_exec_t, zabbix_tmp_t, zarafa_deliver_log_t, zarafa_deliver_tmp_t, zarafa_gateway_log_t, zarafa_ical_log_t, zarafa_indexer_log_t, zarafa_indexer_tmp_t, zarafa_monitor_log_t, zarafa_server_log_t, zarafa_server_tmp_t, zarafa_spooler_log_t, zarafa_var_lib_t, zebra_log_t, zebra_tmp_t, zoneminder_content_t, zoneminder_exec_t, zoneminder_htaccess_t, zoneminder_log_t, zoneminder_ra_content_t, zoneminder_rw_content_t, zoneminder_script_exec_t, zoneminder_var_lib_t, zos_remote_exec_t.
Then execute:
restorecon -v '/httpboot/inspector.ipxe'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that httpd should be allowed getattr access on the inspector.ipxe file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -i my-httpd.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:default_t:s0
Target Objects                /httpboot/inspector.ipxe [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           httpd-2.4.6-67.el7.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-166.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     rhos-dave.demo.mbu.redhat.com
Platform                      Linux rhos-dave.demo.mbu.redhat.com
                              3.10.0-693.el7.x86_64 #1 SMP Thu Jul 6 19:56:57
                              EDT 2017 x86_64 x86_64
Alert Count                   22
First Seen                    2017-08-11 11:49:53 EDT
Last Seen                     2017-08-21 16:47:55 EDT
Local ID                      74632bb4-0c53-4cff-9ddb-12604b39478b

Raw Audit Messages
type=AVC msg=audit(1503348475.343:394927): avc:  denied  { getattr } for  pid=11879 comm="httpd" path="/httpboot/inspector.ipxe" dev="vda1" ino=130030691 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file


type=SYSCALL msg=audit(1503348475.343:394927): arch=x86_64 syscall=stat success=no exit=EACCES a0=5646113f5d70 a1=7ffee28f97d0 a2=7ffee28f97d0 a3=34 items=0 ppid=1452 pid=11879 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: httpd,httpd_t,default_t,file,getattr

Version-Release number of selected component (if applicable):

# rpm -qa | grep inspector
python-ironic-inspector-client-1.11.0-1.el7ost.noarch
openstack-ironic-inspector-5.0.1-1.el7ost.noarch
How reproducible:
100%

Steps to Reproduce:
1. install director
2. restorecon -rv /httpboot
3. wget -O /dev/null http://<DIRECTOR_IP>:8088/inspector.ipxe

Actual results:
# wget -O /dev/null http://10.9.70.4:8088/inspector.ipxe
--2017-08-21 16:52:02--  http://10.9.70.4:8088/inspector.ipxe
Connecting to 10.9.70.4:8088... connected.
HTTP request sent, awaiting response... 403 Forbidden
2017-08-21 16:52:02 ERROR 403: Forbidden.


Expected results:
able to successfully download ipxe roms

Additional info:
these 2 commands would fix a broken system:
# semanage fcontext --add -t httpd_sys_content_t '/httpboot(/.*)?'
# restorecon -rv /httpboot

perhaps the fcontext above should be added to the ironic inspector rpm.

Comment 1 Dmitry Tantsur 2017-09-19 18:34:02 UTC
I suspect we're missing something in https://github.com/openstack/puppet-ironic/blob/master/manifests/pxe.pp

Comment 2 Ilya Etingof 2017-10-10 13:22:48 UTC
First take: https://github.com/redhat-openstack/openstack-selinux/pull/15

Comment 3 Ilya Etingof 2017-10-11 15:03:33 UTC
Merged upstream

Comment 9 errata-xmlrpc 2018-02-13 16:38:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0311


Note You need to log in before you can comment on or make changes to this bug.