Description of problem: When performing a content export, the export succeeds but SELinux denial errors are logged in journal. Version-Release number of selected component (if applicable): 6.13.0 snap 11 How reproducible: always Steps to Reproduce: 1. Have a Satellite with some content synced. 2. Run content export (no matter the type nor format) # hammer content-export complete repository --format importable --organization-id 1 --id 2 Actual results: Errors like following seen in journal: Feb 23 04:06:05 satellite.redhat.com /SetroubleshootPrivileged.py[37552]: failed to retrieve rpm info for /var/lib/selinux/targeted/active/modules/400/pulpcore Feb 23 04:06:09 satellite.redhat.com setroubleshoot[37536]: SELinux is preventing /usr/bin/python3.9 from write access on the directory Export-<product_name>. For complete SELinux messages run: sealert -l fb7d5ec5-a1b6-4cef-855c-1232d8dc0533 Expected results: No such errors in journal. Additional info: Setting fcontext to pulpcore_var_lib_t for the particular directory resolves the issue: # semanage fcontext -a -t pulpcore_var_lib_t /var/lib/pulp/exports/Default_Organization/Export-<product_name> # restorecon -v /var/lib/pulp/exports/Default_Organization/Export-<product_name>
As this was reported a while back on a snap, is this still an issue being seen on 6.13 GA or 6.14 development builds?
Yes, the issue has been just reproduced on 6.14.0 snap 10 and 6.13.3 snap 2: Aug 04 07:55:45 satellite.redhat.com /SetroubleshootPrivileged.py[11396]: failed to retrieve rpm info for /var/lib/selinux/targeted/active/modules/400/pulpcore Aug 04 07:55:47 satellite.redhat.com setroubleshoot[11368]: SELinux is preventing /usr/bin/python3.9 from write access on the directory labeled var_lib_t. For complete SELinux messages run: sealert -l 66186877-c5c6-455f-ad29-6c58aee48b31
@Pulp Team: /var/lib/pulp/export is something that Katello/Satellite defines as a default export path (https://github.com/theforeman/puppet-foreman_proxy_content/blob/96258dd5e8a36e9f94e6ba7d3a04bcbfbfd7a57c/manifests/init.pp#L238) However, we think now that Pulp2 is dead-dead-dead, https://github.com/pulp/pulpcore-selinux/blob/main/pulpcore.fc#L18-L24 can be simplified to something like /var/lib/pulp(/.*)? gen_context(system_u:object_r:pulpcore_var_lib_t,s0) /var/lib/pulp/pulpcore_static(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
Ewoud opened a nice PR for that change: https://github.com/pulp/pulpcore-selinux/pull/69