Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
SELinux prevents Satellite 6.10.0's Pulp (repo syncing) from using a web proxy:
type=AVC msg=audit(10/27/2021 16:18:13.719:1440) : avc: denied { name_connect } for pid=24391 comm=pulpcore-worker dest=8080 scontext=system_u:system_r:pulpcore_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket permissive=1
This occurs even when the proxy is running on a standard web proxy port (8080, 8118, 8123, 10001-10010)
We have workarounds that can be added to the docs, but there is no good reason why a user should have to do a workaround when the proxy is running on a standard web proxy port.
Workarounds for docs:
If the web proxy is running on a standard proxy port (8080, labelled http_cache_port_t):
$ semanage port -m -t http_port_t -p tcp 8080
(This means 8080 now has both labels on it)
If the web proxy is running on a non-standard proxy port that is undefined (10011):
$ semanage port -a -t http_port_t -p tcp 10011
(This means 10011 now has only 1 label on it)
If the web proxy is running on a non-standard proxy port that is defined for some other purpose (8082, labelled us_cli_port_t):
$ semanage port -m -t http_port_t -p tcp 8082
(This means 8082 now has both labels on it)
Version-Release number of selected component (if applicable):
satellite-6.10.0-0.9.beta.el7sat.noarch
pulpcore-selinux-1.2.6-1.el7pc.x86_64
Upstream fix under review:
https://github.com/pulp/pulpcore-selinux/pull/41
Comment 1Tanya Tereshchenko
2021-10-31 10:16:41 UTC
Re: Comment 2:
It is not a duplicate.
To clarify, this bug should be for when the web proxy is running on a standard web proxy port. That should work out of the box, via the code change implemented in pulpcore-selinux 1.2.7.
I will create a separate bug for a docs update for the scenario of a non-standard proxy port.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: Satellite 6.11 Release), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2022:5498
Description of problem: SELinux prevents Satellite 6.10.0's Pulp (repo syncing) from using a web proxy: type=AVC msg=audit(10/27/2021 16:18:13.719:1440) : avc: denied { name_connect } for pid=24391 comm=pulpcore-worker dest=8080 scontext=system_u:system_r:pulpcore_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket permissive=1 This occurs even when the proxy is running on a standard web proxy port (8080, 8118, 8123, 10001-10010) We have workarounds that can be added to the docs, but there is no good reason why a user should have to do a workaround when the proxy is running on a standard web proxy port. Workarounds for docs: If the web proxy is running on a standard proxy port (8080, labelled http_cache_port_t): $ semanage port -m -t http_port_t -p tcp 8080 (This means 8080 now has both labels on it) If the web proxy is running on a non-standard proxy port that is undefined (10011): $ semanage port -a -t http_port_t -p tcp 10011 (This means 10011 now has only 1 label on it) If the web proxy is running on a non-standard proxy port that is defined for some other purpose (8082, labelled us_cli_port_t): $ semanage port -m -t http_port_t -p tcp 8082 (This means 8082 now has both labels on it) Version-Release number of selected component (if applicable): satellite-6.10.0-0.9.beta.el7sat.noarch pulpcore-selinux-1.2.6-1.el7pc.x86_64 Upstream fix under review: https://github.com/pulp/pulpcore-selinux/pull/41