Bug 1582410 - Templates plugin disallowed to create symlinks
Summary: Templates plugin disallowed to create symlinks
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: SELinux
Version: 6.3.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: 6.4.0
Assignee: Lukas Zapletal
QA Contact: Peter Ondrejka
URL: http://projects.theforeman.org/issues...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-25 07:01 UTC by Lukas Zapletal
Modified: 2019-11-05 23:21 UTC (History)
2 users (show)

Fixed In Version: foreman-selinux-1.18.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-16 19:23:25 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 23700 0 None None None 2018-05-25 08:00:28 UTC

Description Lukas Zapletal 2018-05-25 07:01:25 UTC
When I run the command to import my templates from git I get an SELinux denial:

type=PROCTITLE msg=audit(1526982093.115:5964): proctitle=67697400636C6F6E65002D2D007373683A2F2F676974406769746875622E636F6D2F67676174776172642F47475F4B69636B73746172742E676974002F746D702F6432303138303532322D33313436362D337375657972
type=SYSCALL msg=audit(1526982093.115:5964): arch=c000003e syscall=88 success=no exit=-13 a0=518ccd a1=7817e0 a2=180 a3=7fff05e22ea0 items=0 ppid=15768 pid=15769 auid=4294967295 uid=991 gid=989 euid=991 suid=991 fsuid=991 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm="git" exe="/usr/bin/git" subj=system_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1526982093.115:5964): avc: denied { create } for pid=15769 comm="git" name="tCZtgIQ" scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:passenger_tmp_t:s0 tclass=lnk_file

When running with audit2allow the following policy te is created:

module my-git 1.0;

require {
type passenger_tmp_t;
type passenger_t;
class lnk_file { create getattr unlink };
}

#============= passenger_t ==============
allow passenger_t passenger_tmp_t:lnk_file { create getattr unlink };

Comment 1 Lukas Zapletal 2018-05-25 07:02:25 UTC
Valid 6.3.z bug, patch pending merge.

http://projects.theforeman.org/issues/23700

Comment 4 Peter Ondrejka 2018-09-13 15:44:05 UTC
Assuming the command in question is foreman-rake templates:import ... 
Verified on Sat 6.4 snap 21, no selinux denials experienced when importing git templates

Comment 5 Bryan Kearney 2018-10-16 19:23:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2927


Note You need to log in before you can comment on or make changes to this bug.