Created attachment 474303 [details] cobblerd policy Description of problem: cobbler is not usable in its current state. It should have been obvious to anyone using cobbler/SELinux/Fedora 14 that you can't use it at all. I've reported other bugs (bug 664749, bug 670855, and bug 670864). Could someone with the SELinux crew please install a Fedora 14 VM and cobbler before adding more rules blindly? There's frankly too many denials to make 3 or 4 more bugs about this issue. I have attached the custom policy that I had to create to get cobbler going. The policy does not include the rules for httpd from bug 670864. Version-Release number of selected component (if applicable): cobbler-2.0.10-1.fc14.noarch selinux-policy-3.9.7-20.fc14.noarch selinux-policy-targeted-3.9.7-20.fc14.noarch How reproducible: Always Steps to Reproduce: 1. Install Fedora 14, SELinux enforcing, install cobbler. 2. Bring up Firefox and go to cobbler web interface. 3. Try to login, click on "Sync" button, view kickstart templates, etc. All links should work. Actual results: Cobbler flat out not working. Every SELinux update or cobbler update breaks something. It's like no one is QA'ing the thing at all. I don't have a weird, custom setup so these problems should be visible to anyone. Expected results: Cobbler web interface working. Additional info: I've created custom policies to get me by for now.
We would prefer the avc messages, since we can tell whether or not there is a labelling issue. allow cobblerd_t tftpdir_rw_t:file unlink; allow cobblerd_t tftpdir_rw_t:file { read write getattr }; allow cobblerd_t tftpdir_rw_t:lnk_file { read getattr }; These I believe are caused by a mislabled /var/lib/tftpboot/grub Which should be fixed in the latest f14 policy currently in updates-testing, I believe.
chcon -t cobbler_var_lib_t -R /var/lib/tftpboot/grub Should fix for now.
The first two bugs look like we have marked them as fixed in policy. We rely on the cobbler maintainers to make sure SELinux does not break when they update. We can not know what is going to break and try to react as fast as possible.
Miroslav it looks like the cobbler fixes need to be back ported to F13-Rawhide and put into RHEL6.
Fixed in selinux-policy-3.9.7-22.fc14
selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14
The cobbler issues are fixed with selinux-policy-3.9.7-25.fc14. Thanks.
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.