Bug 1967856 - Katello ping controller calls /usr/bin/systemctl which cannot be allowed by SELinux
Summary: Katello ping controller calls /usr/bin/systemctl which cannot be allowed by S...
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Capsule - Content
Version: 6.9.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: 6.10.0
Assignee: Partha Aji
QA Contact: Stephen Wadeley
Depends On:
Blocks: 1971051
TreeView+ depends on / blocked
Reported: 2021-06-04 08:46 UTC by Stephen Wadeley
Modified: 2021-11-16 14:12 UTC (History)
2 users (show)

Fixed In Version: tfm-rubygem-katello-4.1.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1971051 (view as bug list)
Last Closed: 2021-11-16 14:11:38 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 32724 0 Normal New Prevent calling systemctl from RoR process 2021-06-04 11:56:33 UTC
Red Hat Product Errata RHSA-2021:4702 0 None None None 2021-11-16 14:12:00 UTC

Description Stephen Wadeley 2021-06-04 08:46:08 UTC
Description of problem:

After running automated tests I found:

 ~]# ausearch -m AVC,USER_AVC -ts today
time->Fri Jun  4 09:36:43 2021
type=PROCTITLE msg=audit(1622792203.625:40405): proctitle=7368002D630073797374656D63746C2069732D656E61626C65642070756C70636F72652D6170692E7365727669636520263E2F6465762F6E756C6C
type=SYSCALL msg=audit(1622792203.625:40405): arch=c000003e syscall=4 success=no exit=-13 a0=865110 a1=7fff7aa81710 a2=7fff7aa81710 a3=13 items=0 ppid=19368 pid=15582 auid=4294967295 uid=993 gid=991 euid=993 suid=993 fsuid=993 egid=991 sgid=991 fsgid=991 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:foreman_rails_t:s0 key=(null)
type=AVC msg=audit(1622792203.625:40405): avc:  denied  { getattr } for  pid=15582 comm="sh" path="/usr/bin/systemctl" dev="dm-0" ino=705763 scontext=system_u:system_r:foreman_rails_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file permissive=0

Version-Release number of selected component (if applicable):
 ~]# rpm -q satellite

How reproducible:
I see three AVCs today

Steps to Reproduce:
1. Install Sat6.9.2
2. Run some Robottelo tests over SSH (I was running: tests/foreman/ui/test_contenthost.py::test_positive_end_to_end)
3. Run tests/foreman/sys/test_pulp3_filesystem.py::test_selinux_status

Actual results:
SSHCommandResult(stdout=['type=AVC msg=audit(1622792203.625:40405): avc:  denied  { getattr } for  pid=15582 comm="sh"...070756C70636F72652D6170692E7365727669636520263E2F6465762F6E756C6C', ''], stderr=b'', return_code=0, output_format=None).return_code

Expected results:

Comment 3 Lukas Zapletal 2021-06-04 11:53:48 UTC
This is likely caused by https://github.com/Katello/katello/blob/7c9aa78fb5c5c14ea15af759a9d36fd4a7368377/app/models/katello/ping.rb#L12 which was added recently. We cannot allow executing this command, therefore the code must be updated in Katello.

Comment 8 Bryan Kearney 2021-06-11 20:04:02 UTC
Upstream bug assigned to paji

Comment 9 Bryan Kearney 2021-06-11 20:04:04 UTC
Upstream bug assigned to paji

Comment 10 Bryan Kearney 2021-06-15 04:03:25 UTC
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/32724 has been resolved.

Comment 15 errata-xmlrpc 2021-11-16 14:11:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.