Bug 2232162 - avc denial when importing templates to a local directory using API
Summary: avc denial when importing templates to a local directory using API
Keywords:
Status: NEW
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Templates Plugin
Version: 6.14.0
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Satellite QE Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-15 16:25 UTC by Peter Ondrejka
Modified: 2023-08-16 00:19 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Peter Ondrejka 2023-08-15 16:25:26 UTC
Description of problem:

Importing templates to a local directory fails due to the avc denial. Even though the file has httpd_sys_rw_content_t assigned

Version-Release number of selected component (if applicable):
6.14

How reproducible:
always

Steps to Reproduce:
- To reproduce manually prepare a local file and import templates as described in https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/managing_hosts/synchronizing_templates_repositories_managing-hosts#Synchronizing_Templates_with_a_Local_Directory_Using_the_API_managing-hosts
- reproducible using robottelo automation too 

Actual results:

Api call fails with:
500 Server Error: Internal Server Error for url: https://<satellite_hostname>:443/api/v2/templates/import

automation logs say:

"error": {"message":"Using file-based synchronization, but couldn't access /usr/share/foreman_templates/vTioyEjTKn. Please check the access permissions/SELinux and make sure it is readable/writable for the web application user account, typically 'foreman'."}

aureport -a on satellite says 
8/15/2023 12:03:29 puma srv tp 002 system_u:system_r:foreman_rails_t:s0 4 dir getattr unconfined_u:object_r:httpd_sys_rw_content_t:s0 denied 368

audit2allow -a

#============= foreman_rails_t ==============
allow foreman_rails_t httpd_sys_rw_content_t:dir getattr;


Expected results:
Success

Additional info:
- Reproducer available, not occurring in 6.13
- works with setenforce 0
- hit by robotello tests (e.g. tests/foreman/api/test_templatesync.py::TestTemplateSyncTestCase::test_positive_export_and_import_with_metadata)


Note You need to log in before you can comment on or make changes to this bug.