Bug 484681 - /usr/bin/rhn-config-schema.pl not needed in /etc/sudoers
/usr/bin/rhn-config-schema.pl not needed in /etc/sudoers
Product: Red Hat Satellite 5
Classification: Red Hat
Component: Server (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Jan Pazdziora
wes hayutin
Depends On:
Blocks: 457079
  Show dependency treegraph
Reported: 2009-02-09 09:57 EST by Jan Pazdziora
Modified: 2009-09-10 15:11 EDT (History)
1 user (show)

See Also:
Fixed In Version: sat530
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-09-10 15:11:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan Pazdziora 2009-02-09 09:57:26 EST
Description of problem:

The default installation of Satellite 5.3.0 adds /usr/bin/rhn-config-schema.pl to alias INSTALL_RHN in /etc/sudoers.

I've grepped Spacewalk source and rhn-config-schema.pl appears to be called in two places -- in spacewalk/setup/lib/Spacewalk/Setup.pm, and in web/modules/rhn/RHN/SatInstall.pm. That Spacewalk::Setup is being used by root, so no sudo is needed (and called) there. That RHN::SatInstall calls

sub populate_tablespace_name {
  my $class = shift;
  my $tablespace_name = shift;

  my $sat_schema = File::Spec->catfile(DEFAULT_RHN_ETC_DIR, 'universe.satellite.sql');
  my $sat_schema_deploy =
    File::Spec->catfile(DEFAULT_RHN_ETC_DIR, 'universe.deploy.sql');

  my $ret = system("/usr/bin/sudo", "/usr/bin/rhn-config-schema.pl",
                   "--source=" . $sat_schema,
                   "--target=" . $sat_schema_deploy,

  if ($ret) {
    throw 'There was a problem populating the universe.deploy.sql file.';


But the function / method populate_tablespace_name is only called from method populate_database of RHN::SatInstall, and populate_database not used in the whole Spacewalk codebase. Therefore I assume it is dead code which can be removed, and so can /usr/bin/rhn-config-schema.pl from /etc/sudoers.

Note: I did this scan through our code to figure out if there are some commands that need additional SELinux treatment.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Install Satellite 5.3.0.
2. Look into /etc/sudoers.
Actual results:

/usr/bin/rhn-config-schema.pl is there.

Expected results:

/usr/bin/rhn-config-schema.pl is not there and Satellite continues to work OK.

Additional info:

This bug was modelled based on bug 484680.
Comment 1 Jan Pazdziora 2009-02-10 07:25:20 EST
The proposed change is to remove the INSTALL_RHN section and merge whatever needs to be there to CONFIG_RHN. The proposed sudoers.rhn is below. I've tested that with this, the Satellite/Spacewalk works and runs external commands fine.

## RHN specifics ##
Cmnd_Alias CONFIG_RHN = /usr/sbin/rhn-sat-restart-silent,\
                        /etc/rc.d/np.d/step Monitoring install,\
                        /etc/rc.d/np.d/step MonitoringScout install,\
                        /etc/rc.d/np.d/step Monitoring uninstall,\
                        /etc/rc.d/np.d/step MonitoringScout uninstall,\
                        /sbin/service Monitoring restart,\
                        /sbin/service MonitoringScout restart,\
                        /sbin/service taskomatic restart

# The CONFIG_RHN commands are required for reconfiguration of a
# running RHN Satellite.  They should be enabled for proper operation
# of the RHN Satellite.
apache  ALL=(root)      NOPASSWD: CONFIG_RHN
tomcat  ALL=(root)      NOPASSWD: CONFIG_RHN

# These two directives allow tomcat and apache to invoke CONFIG_RHN
# commands via sudo even without a real tty
Defaults:tomcat !requiretty
Defaults:apache !requiretty
Comment 2 Clifford Perry 2009-02-10 12:04:53 EST
This is a throw back from the old Installer - where we had command line install laid down packages. The WebUI then went through configuration/installation of Satellite to get it running, with many many steps, unlike the new WebUI portion that just asks for Username/password to be created for Sat Admin account. 

Comment 3 Jan Pazdziora 2009-02-11 02:25:57 EST
Reassigning to myself as the bugzillas are not tracked against the SELinux feature.
Comment 4 Jan Pazdziora 2009-02-11 02:28:03 EST
The previous comment should have been "are *now*".
Comment 5 Jan Pazdziora 2009-02-17 05:18:54 EST
Committed to Spacewalk repo, 2fd863426ebf83cda3705b68fe98b48cbb0873e2 and e0e2df05d89a00945517c9403603a45e9a16c7f3.
Comment 6 Jan Pazdziora 2009-02-24 07:30:50 EST
With compose Satellite-5.3.0-RHEL5-re20090220.1 available, moving ON_QA.
Comment 7 wes hayutin 2009-02-25 14:05:07 EST
[root@grandprix ~]# cat /etc/sudoers | grep  /usr/bin/rhn-config-schema.pl
[root@grandprix ~]# 

ISO: Satellite-5.3.0-RHEL5-re20090220.1-i386-embedded-oracle.iso
Comment 8 Miroslav Suchý 2009-08-26 05:28:11 EDT
[root@xen5 ~]# grep rhn-config-schema.pl /etc/sudoers
[root@xen5 ~]#

satellite works fine

verified in stage on xen5
Comment 9 Brandon Perkins 2009-09-10 15:11:35 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.