Created attachment 544628 [details] cobbler AVC log Description of problem: Cobbler 2.2.1 is sitting in Fedora updates-testing, but it requires new access permissions to perform a sync. Version-Release number of selected component (if applicable): cobbler-2.2.1-1.fc15.noarch selinux-policy-3.9.16-48.fc15.noarch How reproducible: Always Steps to Reproduce: 1. Upgrade cobber 2.0.11 to 2.2.1 2. Log in to web interface 3. Click on "Sync" link. Actual results: Sync fails with permission denied errors. Expected results: Sync completes. Additional info: I am attaching the AVC log of the denials that I had to allow in order for Sync to work successfully.
I forgot to add that the AVC log also includes denials for cobblerd. I had to enable those as well to get the service cobblerd to start so I could log in to the web interface.
Michael, could you reproduce it with # echo "-w /etc/shadow -p wa" >> /etc/audit/audit.rules # service auditd restart and then try to click on "Sync" link in permissive mode. Then we will see full path of dirs, files. Thank you.
I'm really pressed for time. The Cobbler maintainer needs to fix this.
Michael you have a file named tftp that is labeled etc_t that cobbler wants to write to. The commands Miroslav gave you will allow you to generate AVC messages with full paths. Without that we have no idea what is going on here.
Created attachment 565080 [details] cobbler sync AVC Hi Not sure this is the right place to post, but with Fedora 16 and Cobbler 2.2 I also get some AVC denials with cobbler sync. One is for tftp file: # find / -inum 266151 /etc/xinetd.d/tftp Other is something with dhcpd service restart.
Is cobbler rewriting the /etc/xinetd.d/tftp file?
Yes it is rewritten from a template when you run the sync.
Well we will need a new type for this file and will only be able to fix this in F16 and F17. How does it replace the file. Does it create a temporary file and then rename it? If so, what is the name of the file.
I don't actually know about that for sure. At least I didn't see an AVC for other file name. What about the error with systemctl?
Hopefully scott will answer the question about tftp file. What is cobbler trying to do here? Reload the inetd service?
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
Cobbler doesn't write a temp file, it rewrites the file in-place via a template (/etc/cobbler/tftpd.template).
Fixed in selinux-policy-3.10.0-117.fc17
selinux-policy-3.10.0-117.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-117.fc17
selinux-policy-3.10.0-118.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-118.fc17
Package selinux-policy-3.10.0-118.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-118.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-6452/selinux-policy-3.10.0-118.fc17 then log in and leave karma (feedback).
What does the fix for this bug actually look like? Does the fix also allow that httpd_cobbler_content_t stuff? If so, wouldn't the correct fix for that be what's mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=813206#c4 ?
selinux-policy-3.10.0-118.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.