Summary: SELinux is preventing /usr/bin/python "write" access on cobbler. Detailed Description: SELinux denied access requested by cobblerd. It is not expected that this access is required by cobblerd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:cobblerd_t:s0 Target Context system_u:object_r:httpd_cobbler_content_t:s0 Target Objects cobbler [ dir ] Source cobblerd Source Path /usr/bin/python Port <Unknown> Host (removed) Source RPM Packages python-2.6.4-27.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-76.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.34.7-66.fc13.i686 #1 SMP Wed Dec 15 07:40:25 UTC 2010 i686 i686 Alert Count 1 First Seen tor 6 jan 2011 21.05.49 Last Seen tor 6 jan 2011 21.05.49 Local ID efd19209-30ec-4428-87a8-15e50479d512 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1294344349.260:43396): avc: denied { write } for pid=13651 comm="cobblerd" name="cobbler" dev=sda2 ino=709361 scontext=unconfined_u:system_r:cobblerd_t:s0 tcontext=system_u:object_r:httpd_cobbler_content_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1294344349.260:43396): arch=40000003 syscall=40 success=no exit=-13 a0=b5d49ef8 a1=0 a2=74eb880 a3=b5d4cf70 items=0 ppid=1 pid=13651 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="cobblerd" exe="/usr/bin/python" subj=unconfined_u:system_r:cobblerd_t:s0 key=(null) Hash String generated from catchall,cobblerd,cobblerd_t,httpd_cobbler_content_t,dir,write audit2allow suggests: #============= cobblerd_t ============== #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types: # tmp_t, cobbler_var_lib_t, tftpdir_rw_t, etc_t, rsync_etc_t, cobbler_tmp_t, httpd_cobbler_rw_content_t, var_lib_t, var_log_t, named_zone_t, cobbler_var_log_t, root_t allow cobblerd_t httpd_cobbler_content_t:dir write;
cobbler sync task started: 2011-01-06_210548_sync task started (id=Sync, time=Thu Jan 6 21:05:48 2011) running pre-sync triggers cleaning trees removing: /var/www/cobbler/pub removing: /var/lib/tftpboot/grub/images removing: /var/lib/tftpboot/grub/grub-x86.efi Exception occured: <type 'exceptions.OSError'> Exception value: [Errno 13] Permission denied: '/var/lib/tftpboot/grub/grub-x86.efi' Exception Info: File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1180, in rmfile os.unlink(path) Exception occured: <class 'cobbler.cexceptions.CX'> Exception value: 'Error deleting /var/lib/tftpboot/grub/grub-x86.efi' Exception Info: File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 95, in run rc = self._run(self) File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 184, in runner return self.remote.api.sync(self.options.get("verbose",False),logger=self.logger) File "/usr/lib/python2.6/site-packages/cobbler/api.py", line 610, in sync return sync.run() File "/usr/lib/python2.6/site-packages/cobbler/action_sync.py", line 110, in run self.clean_trees() File "/usr/lib/python2.6/site-packages/cobbler/action_sync.py", line 199, in clean_trees utils.rmtree_contents(self.grub_dir,logger=self.logger) File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1192, in rmtree_contents rmtree(x,logger=logger) File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1197, in rmtree return rmfile(path,logger=logger) File "/usr/lib/python2.6/site-packages/cobbler/utils.py", line 1186, in rmfile raise CX(_("Error deleting %s") % path) !!! TASK FAILED !!!
Looks like /var/lib/tftpboot/grub needs to be labeled correctly. /var/lib/tftpboot/grub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
When installing cobbler I run cobbler check 3 : you need to set some SELinux content rules to ensure cobbler serves content correctly in your SELinux environment, run the following: /usr/sbin/semanage fcontext -a -t public_content_t "/var/lib/tftpboot/.*" && /usr/sbin/semanage fcontext -a -t public_content_t "/var/www/cobbler/images/.*" 4 : you need to set some SELinux rules if you want to use cobbler-web (an optional package), run the following: /usr/sbin/semanage fcontext -a -t httpd_sys_content_rw_t "/var/lib/cobbler/webui_sessions/.*" After following instructions cobbler check The following are potential configuration items that you may want to fix: 1 : you need to set some SELinux content rules to ensure cobbler serves content correctly in your SELinux environment, run the following: /usr/sbin/semanage fcontext -a -t public_content_t "/var/lib/tftpboot/.*" && /usr/sbin/semanage fcontext -a -t public_content_t "/var/www/cobbler/images/.*" 2 : you need to set some SELinux rules if you want to use cobbler-web (an optional package), run the following: /usr/sbin/semanage fcontext -a -t httpd_sys_content_rw_t "/var/lib/cobbler/webui_sessions/.*" A note is that cobbler replaced my named.conf without asking or saving.
Per, try to execute chcon -R -t cobbler_var_lib_t /var/lib/tftpboot/grub Should fix for now. Fixed in selinux-policy-3.7.19-81.fc13
I have opened a new cobbler bug to remove these invalid instructions. https://bugzilla.redhat.com/show_bug.cgi?id=667933
selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.