Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 840470

Summary:	browsing to the headpin page fails due to selinux avc: denied comm="httpd" dest=5000 (dest=5001) scontext=system_u:system_r:httpd_t:s0
Product:	[Retired] Subscription Asset Manager	Reporter:	Eric Sammons <esammons>
Component:	katello	Assignee:	Bryan Kearney <bkearney>
Status:	CLOSED WONTFIX	QA Contact:	SAM QE List <sam-qe-list>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	1.2	CC:	lzap
Target Milestone:	rc	Keywords:	Triaged
Target Release:	1.2
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	847027 (view as bug list)		Environment:
Last Closed:	2012-08-15 10:21:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	816564, 847027

Description Eric Sammons 2012-07-16 13:03:41 UTC

Description of problem:
Installing a new headpin with selinux enabled will lead to headpin being inaccessible.

Version-Release number of selected component (if applicable):
katello-headpin-0.2.24-1
Fedora-16


Steps to Reproduce:
1. Install F-16 @Base
   a. getenforce should return enforcing.
2. Install katello-headpin-all (0.2.24-1)
3. katello-configure --deployment=headpin
4. navigate your web browser to https://headpin.fqdn.com/headpin
  
Actual results:
Service Temporarily Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Apache/2.2.22 (Fedora) Server at brainslug.usersys.redhat.com Port 443

---- /var/log/audit/audit.log
type=AVC msg=audit(1342443488.476:6102): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6102): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef1bd928 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1342443488.476:6103): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5001 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6103): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef08a438 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)


Expected results:
katello login page

Comment 1 Lukas Zapletal 2012-08-15 10:21:53 UTC

Please report on "SELinux" component.

Eric there is a bug in Fedora 16 SELinux base package that is incompatible with Katello builds created in Koji (since we build on RHEL now). Before installing Katello please apply all Fedora 16 updates (or at least or selinux relevant).

This is docummented in our installation guide as we cannot do much about it. Fedora 17+ is okay, RHEL 6 too.

You can check if you are affected with this bug by checking if katello selinux module is loaded. If not, its the bug I described above:

    semodule -l | grep katello pulp

Please re-open if it still does not work with updated selinux.

Comment 2 Lukas Zapletal 2012-08-15 10:26:29 UTC

The original bugreport linked from the install page is:

https://bugzilla.redhat.com/show_bug.cgi?id=843030

For any case, can you report:

1) rpm -qa | grep selinux

2) semodule -l | grep katello pulp

If its not the same issue, we need to re-open.