This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 637833 - 'rhncfg-manager download-channel' does not deploy selinux context
'rhncfg-manager download-channel' does not deploy selinux context
Status: CLOSED ERRATA
Product: Red Hat Satellite 5
Classification: Red Hat
Component: Client (Show other bugs)
540
All Linux
medium Severity medium
: ---
: ---
Assigned To: Michael Mráka
Jiri Kastner
:
Depends On:
Blocks: 640135 sat54-errata
  Show dependency treegraph
 
Reported: 2010-09-27 10:55 EDT by Pavel Novotny
Modified: 2011-03-07 04:25 EST (History)
3 users (show)

See Also:
Fixed In Version: rhncfg-5.9.27-6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-03-07 04:25:13 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Pavel Novotny 2010-09-27 10:55:18 EDT
Description of problem:
'rhncfg-manager download-channel' command does not deploy SELinux file context. Instead, system-default context on client machine is used.

Version-Release number of selected component (if applicable):
rhncfg-management-5.9.27-1.el5sat

How reproducible:
Always

Steps to Reproduce:
1. In Satellite 540's WebUI create config channel with config file(s) in /tmp/ directory.
2. Set the SELinux context to 'root:object_r:unconfined_t'
3. On the client machine run 'rhncfg-manager download-channel -t /tmp/ <config-channel-name>'
4. run 'ls -Z /tmp/<config-channel-name>/tmp/'
  
Actual results:
The SELinux context is system default, usually 'root:object_r:tmp_t'.

Expected results:
The SELinux context should be same as on the server, i.e., 'root:object_r:unconfined_t'.

Additional info:
This behaviour can cause trouble if we run 'rhncfg-manager download-channel' and then 'rhncfg-manager upload-channel', because the second command deploys the client system-default context back onto server, thus changes the SELinux context field without user's knowledge.
Comment 3 Michael Mráka 2011-01-06 08:26:44 EST
It's been fixed in spacewalk master by 
commit 2272486d9037b0bcead4edf0384f1d47778f8c8b
    637833 - reused shared file deploy code
commit f2d5222dd5eb72653ee6201d87e6571d74e2eb20
    637833 - moved file deploy code into shared module

Fixed spacewalk package rhncfg-5.9.43-1.
Comment 4 Michael Mráka 2011-01-06 09:42:50 EST
Fixed in satellite git
commit 23aabf14f64f7022f0bea98ec13b882c922760ed
    637833 - reused shared file deploy code
    (cherry picked from commit 2272486d9037b0bcead4edf0384f1d47778f8c8b)
commit 39676e91219caaa53b7668ef11c81c928c9ec292
    637833 - reused shared file deploy code
    (cherry picked from commit f2d5222dd5eb72653ee6201d87e6571d74e2eb20)
Comment 7 Jiri Kastner 2011-01-24 09:51:59 EST
RHEL5:
[root@rlx-0-12 ~]# rhncfg-manager download-channel test-644985 -t /tmp/
Deploying /tmp/test-644985/tmp/config.cfg
Deploying /tmp/test-644985/tmp/config.cfg.ln
[root@rlx-0-12 ~]# ls -Z /tmp/test-644985/tmp/
-rw-r--r--  root root system_u:object_r:rpm_script_tmp_t config.cfg
lrwxrwxrwx  root root system_u:object_r:rpm_script_tmp_t config.cfg.ln -> /tmp/config.cfg
[root@rlx-0-12 ~]# rhncfg-manager download-channel test-644985 -t /tmp/
Deploying /tmp/test-644985/tmp/config.cfg
Deploying /tmp/test-644985/tmp/config.cfg.ln
[root@rlx-0-12 ~]# ls -Z /tmp/test-644985/tmp/
-rw-r--r--  root root root:object_r:tmp_t              config.cfg
lrwxrwxrwx  root root root:object_r:tmp_t              config.cfg.ln -> /tmp/config.cfg
Comment 13 errata-xmlrpc 2011-03-07 04:25:13 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0323.html

Note You need to log in before you can comment on or make changes to this bug.