Bug 826528 - Selinux denies cobbler to write tftp config
Selinux denies cobbler to write tftp config
Status: CLOSED DUPLICATE of bug 816309
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
Depends On:
  Show dependency treegraph
Reported: 2012-05-30 08:32 EDT by Pablo Iranzo Gómez
Modified: 2013-06-13 05:05 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-10-15 11:03:38 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Pablo Iranzo Gómez 2012-05-30 08:32:15 EDT
Description of problem:
SELinux denies cobbler writting tftp

Version-Release number of selected component (if applicable):
[root@Merak ~]# rpm -q cobbler
[root@Merak ~]# rpm -q selinux-policy
[root@Merak ~]# rpm -qa|grep -i target

How reproducible:
Execute cobbler sync

Steps to Reproduce:
1. cobbler sync
Actual results:
type=AVC msg=audit(1338380856.563:62132): avc:  denied  { write } for  pid=3098 comm="cobblerd" name="tftp" dev=dm-0 ino=10881600 scontext=system_u:system_r:cobblerd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1338380856.563:62132): arch=c000003e syscall=2 success=no exit=-13 a0=7fd2280f2d30 a1=242 a2=1b6 a3=0 items=0 ppid=1 pid=3098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cobblerd" exe="/usr/bin/python" subj=system_u:system_r:cobblerd_t:s0 key=(null)

rendering DHCP files
generating /etc/dhcp/dhcpd.conf
rendering TFTPD files
generating /etc/xinetd.d/tftp
Exception occured: <type 'exceptions.IOError'>
Exception value: [Errno 13] Permission denied: '/etc/xinetd.d/tftp'
Exception Info:
  File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 89, in run
    rc = self._run(self)
   File "/usr/lib/python2.6/site-packages/cobbler/remote.py", line 184, in runner
    return self.remote.api.sync(self.options.get("verbose",False),logger=self.logger)
   File "/usr/lib/python2.6/site-packages/cobbler/api.py", line 701, in sync
    return sync.run()
   File "/usr/lib/python2.6/site-packages/cobbler/action_sync.py", line 142, in run
   File "/usr/lib/python2.6/site-packages/cobbler/modules/manage_in_tftpd.py", line 131, in write_tftpd_files
    self.templar.render(template_data, metadata, self.settings_file, None)
   File "/usr/lib/python2.6/site-packages/cobbler/templar.py", line 167, in render
    fd = open(out_path, "w+")


Expected results:
cobbler should be able to generate that configuration file and output something similar to:
Iniciando dhcpd: [  OK  ]

received on stderr: 
running shell triggers from /var/lib/cobbler/triggers/sync/post/*
running python triggers from /var/lib/cobbler/triggers/change/*
running python trigger cobbler.modules.scm_track
running shell triggers from /var/lib/cobbler/triggers/change/*

Additional info:
Comment 2 Miroslav Grepl 2012-05-30 09:37:14 EDT
This is a problem with the latest cobbler. We should need

/etc/xinetd\.d/tftp --  gen_context(system_u:object_r:tftpd_etc_t,s0

in the policy. But we can say to create this file with this label only on Fedora16+.

We have another transition for /etc in the cobbler policy on RHEL6.3. So we would get duplicate transitions.

I think we could add labeling and cobbler sync could run restorecon when /etc/xinetd\.d/tftp is created. I hope the cobbler sync runs as unconfined in this phase.
Comment 4 RHEL Product and Program Management 2012-07-10 04:19:14 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 5 RHEL Product and Program Management 2012-07-10 21:56:29 EDT
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 6 Miroslav Grepl 2012-10-15 11:03:38 EDT

*** This bug has been marked as a duplicate of bug 816309 ***

Note You need to log in before you can comment on or make changes to this bug.