Hide Forgot
+++ This bug was initially created as a clone of Bug #700505 +++ Description of problem: Due to changes in the startup scripts, pki tomcat6 instances (on tip and on ipa branch) currently run unconfined. That is, the pki selinux policy is present but is not being used. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Needs some additional information - how to verify fix? thx
Patch in BZ 700505: 6.2 branch: [vakwetu@goofy-vm6 base]$ svn ci -m "Resolves #700505 - pki tomcat6 instances currently running unconfined" Sending base/common/scripts/functions Sending base/selinux/src/pki.fc Sending base/selinux/src/pki.if Sending base/selinux/src/pki.te Transmitting file data .... Committed revision 2128.
How to verify: 1. make sure selinux is enabled and enforcing 2. pkicreate an instance -- or install ipa 3. installation should complete successfully. 4. Check context of the java process ps -efZ |grep pki-ca It should show something like this : unconfined_u:system_r:pki_ca_t:s0 pkiuser 25191 1 0 09:37 ? 00:00:18 /usr/lib/jvm/java/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath :/usr/share/tomcat6/bin/bootstrap.jar:/usr/share/tomcat6/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki-ca -Dcatalina.home=/usr/share/tomcat6 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat6/temp -Djava.util.logging.config.file=/var/lib/pki-ca/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 vakwetu 25794 14003 0 10:29 pts/0 00:00:00 grep pki-ca The important bit is unconfined_u:system_r:pki_ca_t:s0 pkiuser and in particular pki_ca_t . Before, it used to be unconfined_java_t
Patch 'pki/patches/pki-core-9.0.3-r2128.patch' was previously checked-in as revision #2129. IPA_v2_RHEL_6_ERRATA_BRANCH: # cd pki # svn status | grep -v ^$ | grep -v ^P | grep -v ^X | grep -v ^? M specs/pki-core.spec # svn commit Sending specs/pki-core.spec Transmitting file data . Committed revision 2134.
Created attachment 518326 [details] patch to allow server to come up if selinux disabled
6,2: Patch reviewed in BZ 700505: svn ci -m "Resolves #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled" base/common/ Sending base/common/scripts/functions Transmitting file data . Committed revision 2147.
VERIFIED Version Info. ####################################### [root@ipaqavma ~]# rpm -qi pki-ca Name : pki-ca Relocations: (not relocatable) Version : 9.0.3 Vendor: Red Hat, Inc. Release : 20.el6 Build Date: Mon 03 Oct 2011 08:08:55 PM EDT Install Date: Tue 08 Nov 2011 01:05:46 AM EST Build Host: x86-002.build.bos.redhat.com Correct context is set now. ####################################### [root@ipaqavma ~]# ps -efZ |grep pki-ca unconfined_u:system_r:pki_ca_t:s0 pkiuser 2361 1 0 08:42 ? 00:00:25 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath :/usr/share/tomcat6/bin/bootstrap.jar:/usr/share/tomcat6/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki-ca -Dcatalina.home=/usr/share/tomcat6 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat6/temp -Djava.util.logging.config.file=/var/lib/pki-ca/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 5020 5002 0 12:50 pts/2 00:00:00 grep pki-ca [root@ipaqavma ~]# [root@ipaqavma ~]# #######################################
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1655.html