Bug #7019
closed
Could not upload inventory when SELinux is enabled
Added by Alexis Mousset over 9 years ago.
Updated over 9 years ago.
Category:
System integration
Description
Rudder 3.1.0, Centos 7:
2015-07-21T11:54:47+0000 error: /default/doInventory/methods/'any'/default/sendInventory/files/'/var/rudder/inventories'[0]: Finished command related to promiser '/var/rudder/inventories' -- an error occurred, returned 22
2015-07-21T11:54:47+0000 error: /default/doInventory/methods/'any'/default/sendInventory/files/'/var/rudder/inventories'[0]: Transformer '/var/rudder/inventories/server-root.ocs' => '/usr/bin/curl -k -f -s --proxy '' --user rudder:rudder -T /var/rudder/inventories/server-root.ocs https://127.0.0.1/inventory-updates/' returned error
2015-07-21T11:54:47+0000 error: /default/doInventory/methods/'any'/default/sendInventory/files/'/var/rudder/inventories'[0]: Finished command related to promiser '/var/rudder/inventories' -- an error occurred, returned 22
2015-07-21T11:54:47+0000 error: /default/doInventory/methods/'any'/default/sendInventory/files/'/var/rudder/inventories'[0]: Transformer '/var/rudder/inventories/server-root.ocs.sign' => '/usr/bin/curl -k -f -s --proxy '' --user rudder:rudder -T /var/rudder/inventories/server-root.ocs.sign https://127.0.0.1/inventory-updates/' returned error
The request returns a 403, and works after a setenforce 0.
- Subject changed from Could not upload inventory when SELinux is enbaled to Could not upload inventory when SELinux is enabled
in audit.log:
type=AVC msg=audit(1437480952.366:1982): avc: denied { write } for pid=15973 comm="httpd" name="accepted-nodes-updates" dev="dm-1" ino=68976571 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1437480952.579:1983): avc: denied { write } for pid=3189 comm="httpd" name="accepted-nodes-updates" dev="dm-1" ino=68976571 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
- Related to Bug #7021: When SELinux is enabled, the ncf-api-venv home is owned by root added
- Status changed from New to In progress
Adding the httpd_sys_rw_content_t context to the directories receiving inventories in /var/rudder/inventories fixes the issue.
The rudder-webapp package contains:
chcon -R --type=httpd_sys_content_t /var/rudder/inventories/incoming
chcon -R --type=httpd_sys_content_t /var/rudder/inventories/accepted-nodes-updates
but httpd_sys_content_t is read-only, and chcon changes are temporary.
The is an example of file context packaging on Fedora wiki.
- Assignee set to Alexis Mousset
- Status changed from In progress to Discussion
- Assignee changed from Alexis Mousset to Matthieu CERDA
Using semanage would add a new dependency (policycoreutils-python). We could also split the selinux-related code into a subpackage to keep it optional, or keep chcon (which does not survive a file system relabel or restorecon).
Matthieu, what do you think is the best option?
- Assignee changed from Matthieu CERDA to Alexis Mousset
I would:
- fix the chcon first, to get an immediate fix
- see if we can adjust rudder-packages/rudder-webapp/SOURCES/rudder-webapp.te to declare this directory permissions, and just trigger a restorecon in the package postinst to automatically apply the right perms on it :)
Does it look like a good idea to you ?
- Status changed from Discussion to In progress
I found it is also possible to add a .fc file defining file contexts, and it is clearly the right way to do it.
- Status changed from In progress to Pending technical review
- Assignee changed from Alexis Mousset to Benoît PECCATTE
- Pull Request set to https://github.com/Normation/rudder-packages/pull/719
- Status changed from Pending technical review to Pending release
- % Done changed from 0 to 100
- Status changed from Pending release to Released
This bug has been fixed in Rudder 3.1.1 which was released today.
Also available in: Atom
PDF
Updated by 
Updated by Matthieu CERDA 
Updated by 
Updated by