Bug 670894 - cobblerd and httpd have many denials
Summary: cobblerd and httpd have many denials
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-19 15:48 UTC by Michael Cronenworth
Modified: 2011-01-25 20:58 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.9.7-25.fc14
Clone Of:
Environment:
Last Closed: 2011-01-25 20:58:39 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
cobblerd policy (589 bytes, application/octet-stream)
2011-01-19 15:48 UTC, Michael Cronenworth
no flags Details

Description Michael Cronenworth 2011-01-19 15:48:40 UTC
Created attachment 474303 [details]
cobblerd policy

Description of problem: cobbler is not usable in its current state. It should have been obvious to anyone using cobbler/SELinux/Fedora 14 that you can't use it at all. I've reported other bugs (bug 664749, bug 670855, and bug 670864). Could someone with the SELinux crew please install a Fedora 14 VM and cobbler before adding more rules blindly?

There's frankly too many denials to make 3 or 4 more bugs about this issue. I have attached the custom policy that I had to create to get cobbler going. The policy does not include the rules for httpd from bug 670864.


Version-Release number of selected component (if applicable):
cobbler-2.0.10-1.fc14.noarch
selinux-policy-3.9.7-20.fc14.noarch
selinux-policy-targeted-3.9.7-20.fc14.noarch

How reproducible: Always


Steps to Reproduce:
1. Install Fedora 14, SELinux enforcing, install cobbler.
2. Bring up Firefox and go to cobbler web interface.
3. Try to login, click on "Sync" button, view kickstart templates, etc. All links should work.
  
Actual results: Cobbler flat out not working. Every SELinux update or cobbler update breaks something. It's like no one is QA'ing the thing at all. I don't have a weird, custom setup so these problems should be visible to anyone.


Expected results: Cobbler web interface working.


Additional info:

I've created custom policies to get me by for now.

Comment 1 Daniel Walsh 2011-01-19 16:00:58 UTC
We would prefer the avc messages, since we can tell whether or not there is a labelling issue.

allow cobblerd_t tftpdir_rw_t:file unlink;
allow cobblerd_t tftpdir_rw_t:file { read write getattr };
allow cobblerd_t tftpdir_rw_t:lnk_file { read getattr };

These I believe are caused by a mislabled /var/lib/tftpboot/grub  Which should be fixed in the latest f14 policy currently in updates-testing, I believe.

Comment 2 Daniel Walsh 2011-01-19 16:02:03 UTC
chcon -t cobbler_var_lib_t -R /var/lib/tftpboot/grub

Should fix for now.

Comment 3 Daniel Walsh 2011-01-19 16:09:47 UTC
The first two bugs look like we have marked them as fixed in policy.  We rely
on the cobbler maintainers to make sure SELinux does not break when they
update.  We can not know what is going to break and try to react as fast as
possible.

Comment 4 Daniel Walsh 2011-01-19 16:10:53 UTC
Miroslav it looks like the cobbler fixes need to be back ported to F13-Rawhide and put into RHEL6.

Comment 5 Miroslav Grepl 2011-01-19 16:22:56 UTC
Fixed in selinux-policy-3.9.7-22.fc14

Comment 6 Fedora Update System 2011-01-20 16:04:26 UTC
selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14

Comment 7 Fedora Update System 2011-01-20 19:54:49 UTC
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14

Comment 8 Michael Cronenworth 2011-01-25 14:42:58 UTC
The cobbler issues are fixed with selinux-policy-3.9.7-25.fc14.

Thanks.

Comment 9 Fedora Update System 2011-01-25 20:57:48 UTC
selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.