Bug 2218932 - SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t
Summary: SELinux is preventing pulpcore-worker from read access on the key labeled pul...
Keywords:
Status: VERIFIED
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Pulp
Version: 6.13.0
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: 6.14.0
Assignee: satellite6-bugs
QA Contact: Shweta Singh
URL:
Whiteboard:
: selinux (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-06-30 15:53 UTC by Ganesh Payelkar
Modified: 2023-08-03 05:58 UTC (History)
8 users (show)

Fixed In Version: pulpcore-selinux-1.3.3
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker SAT-18752 0 None None None 2023-07-03 12:10:00 UTC
Red Hat Knowledge Base (Solution) 7024612 0 None None None 2023-07-14 07:00:10 UTC

Description Ganesh Payelkar 2023-06-30 15:53:10 UTC
Description of problem:

SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t

Version-Release number of selected component (if applicable):
satellite-6.13.1-1

How reproducible:
New installation of 6.13

Steps to Reproduce:

 • synchronize the RPM-package repositories
 • publish and promote the CVs and CCVs

Actual results: 

SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that pulpcore-worker should be allowed read access on key labeled pulpcore_server_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'pulpcore-worker' --raw | audit2allow -M my-pulpcoreworker#012# semodule -X 300 -i my-pulpcoreworker.pp#012

SELinux is preventing /usr/bin/python3.9 from view access on the key labeled pulpcore_server_t.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that python3.9 should be allowed view access on key labeled pulpcore_server_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'pulpcore-worker' --raw | audit2allow -M my-pulpcoreworker#012# semodule -X 300 -i my-pulpcoreworker.pp#012


Expected results:

Proper Functioning of Satellite 6 Components with SELinux Context

Additional info:

 - SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t.
 - SELinux is preventing /usr/bin/python3.9 from view access on the key labeled pulpcore_server_t.

Comment 3 Mike DePaulo 2023-06-30 20:44:18 UTC
I released 1.3.3 with the fix:
https://github.com/pulp/pulpcore-selinux/releases/tag/1.3.3

Comment 7 Adam Ruzicka 2023-07-18 17:16:47 UTC
*** Bug 2151664 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.