Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2052032

Summary:	On RHEL8 tomcat_t domain is prevented to create .pki directory on tomcat startup
Product:	[Community] Candlepin (Migrated to Jira)	Reporter:	Rehana <redakkan>
Component:	candlepin	Assignee:	candlepin-bugs
Status:	CLOSED NOTABUG	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.1	CC:	bcourt, lpramuk, ltran, nmoumoul, redakkan
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2051851	Environment:
Last Closed:	2022-02-17 11:44:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2051851
Bug Blocks:

Description Rehana 2022-02-08 14:34:43 UTC

+++ This bug was initially created as a clone of Bug #2051851 +++

Description of problem:
tomcat_t domain is prevented to create .pki directory on tomcat startup
This happens only on RHEL8

Version-Release number of selected component (if applicable):
Satellite 7.0.0
candlepin-selinux-4.1.8-1.el8sat.noarch
tomcatjss-7.7.0-1.module+el8.5.0+11983+6ba118b4.noarch
pki-servlet-engine-9.0.30-3.module+el8.5.0+11388+9e95fe00.noarch


How reproducible:
deterministic

Steps to Reproduce:
1. (Re-)start tomcat service
2. Check for denials

# audit2allow -a


#============= tomcat_t ==============
allow tomcat_t usr_t:dir create;


Actual results:
selinux denials present

Expected results:
no selinux denials

Additional info:
type=AVC msg=audit(1644245745.983:695): avc:  denied  { create } for  pid=14051 comm="java" name=".pki" scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0