Bug 840470 - browsing to the headpin page fails due to selinux avc: denied comm="httpd" dest=5000 (dest=5001) scontext=system_u:system_r:httpd_t:s0
browsing to the headpin page fails due to selinux avc: denied comm="httpd" ...
Status: CLOSED WONTFIX
Product: Subscription Asset Manager
Classification: Red Hat
Component: katello (Show other bugs)
1.2
Unspecified Unspecified
urgent Severity urgent
: rc
: 1.2
Assigned To: Bryan Kearney
SAM QE List
: Triaged
Depends On:
Blocks: sam12-tracker 847027
  Show dependency treegraph
 
Reported: 2012-07-16 09:03 EDT by Eric Sammons
Modified: 2012-08-15 06:26 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 847027 (view as bug list)
Environment:
Last Closed: 2012-08-15 06:21:53 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Eric Sammons 2012-07-16 09:03:41 EDT
Description of problem:
Installing a new headpin with selinux enabled will lead to headpin being inaccessible.

Version-Release number of selected component (if applicable):
katello-headpin-0.2.24-1
Fedora-16


Steps to Reproduce:
1. Install F-16 @Base
   a. getenforce should return enforcing.
2. Install katello-headpin-all (0.2.24-1)
3. katello-configure --deployment=headpin
4. navigate your web browser to https://headpin.fqdn.com/headpin
  
Actual results:
Service Temporarily Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Apache/2.2.22 (Fedora) Server at brainslug.usersys.redhat.com Port 443

---- /var/log/audit/audit.log
type=AVC msg=audit(1342443488.476:6102): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6102): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef1bd928 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1342443488.476:6103): avc:  denied  { name_connect } for  pid=5951 comm="httpd" dest=5001 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1342443488.476:6103): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fcbef08a438 a2=10 a3=7fff47624c8c items=0 ppid=5691 pid=5951 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)


Expected results:
katello login page
Comment 1 Lukas Zapletal 2012-08-15 06:21:53 EDT
Please report on "SELinux" component.

Eric there is a bug in Fedora 16 SELinux base package that is incompatible with Katello builds created in Koji (since we build on RHEL now). Before installing Katello please apply all Fedora 16 updates (or at least or selinux relevant).

This is docummented in our installation guide as we cannot do much about it. Fedora 17+ is okay, RHEL 6 too.

You can check if you are affected with this bug by checking if katello selinux module is loaded. If not, its the bug I described above:

    semodule -l | grep katello pulp

Please re-open if it still does not work with updated selinux.
Comment 2 Lukas Zapletal 2012-08-15 06:26:29 EDT
The original bugreport linked from the install page is:

https://bugzilla.redhat.com/show_bug.cgi?id=843030

For any case, can you report:

1) rpm -qa | grep selinux

2) semodule -l | grep katello pulp

If its not the same issue, we need to re-open.

Note You need to log in before you can comment on or make changes to this bug.