Bug 840470 - browsing to the headpin page fails due to selinux avc: denied comm="httpd" dest=5000 (dest=5001) scontext=system_u:system_r:httpd_t:s0
Summary: browsing to the headpin page fails due to selinux avc: denied comm="httpd" ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Subscription Asset Manager
Classification: Retired
Component: katello
Version: 1.2
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: 1.2
Assignee: Bryan Kearney
QA Contact: SAM QE List
URL:
Whiteboard:
Depends On:
Blocks: sam12-tracker 847027
TreeView+ depends on / blocked
 
Reported: 2012-07-16 13:03 UTC by Eric Sammons
Modified: 2012-08-15 10:26 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 847027 (view as bug list)
Environment:
Last Closed: 2012-08-15 10:21:53 UTC
Embargoed:


Attachments (Terms of Use)

Description Eric Sammons 2012-07-16 13:03:41 UTC
Description of problem:
Installing a new headpin with selinux enabled will lead to headpin being inaccessible.

Version-Release number of selected component (if applicable):
katello-headpin-0.2.24-1
Fedora-16


Steps to Reproduce:
1. Install F-16 @Base
   a. getenforce should return enforcing.
2. Install katello-headpin-all (0.2.24-1)
3. katello-configure --deployment=headpin
4. navigate your web browser to https://headpin.fqdn.com/headpin
  
Actual results:
Service Temporarily Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Apache/2.2.22 (Fedora) Server at brainslug.usersys.redhat.com Port 443

---- /var/log/audit/audit.log
type=AVC msg=audit(1342443488.476:6102): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6102): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef1bd928 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1342443488.476:6103): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5001 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6103): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef08a438 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)


Expected results:
katello login page

Comment 1 Lukas Zapletal 2012-08-15 10:21:53 UTC
Please report on "SELinux" component.

Eric there is a bug in Fedora 16 SELinux base package that is incompatible with Katello builds created in Koji (since we build on RHEL now). Before installing Katello please apply all Fedora 16 updates (or at least or selinux relevant).

This is docummented in our installation guide as we cannot do much about it. Fedora 17+ is okay, RHEL 6 too.

You can check if you are affected with this bug by checking if katello selinux module is loaded. If not, its the bug I described above:

    semodule -l | grep katello pulp

Please re-open if it still does not work with updated selinux.

Comment 2 Lukas Zapletal 2012-08-15 10:26:29 UTC
The original bugreport linked from the install page is:

https://bugzilla.redhat.com/show_bug.cgi?id=843030

For any case, can you report:

1) rpm -qa | grep selinux

2) semodule -l | grep katello pulp

If its not the same issue, we need to re-open.


Note You need to log in before you can comment on or make changes to this bug.