Bug #5808

AVC denied { read } for comm="ruby" name="migrate" dev=dm-0 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file

Added by Jan Pazdziora over 3 years ago. Updated over 3 years ago.

Status:Closed
Priority:Normal
Assigned To:Lukas Zapletal
Category:Packaging
Target version:Foreman - Sprint 24
Difficulty: Bugzilla link:1107684
Found in release: Pull request:
Story points-
Velocity based estimate-
Release1.5.1Release relationshipAuto

Description

With fresh install of Foreman develop on RHEL 6.5 using

https://github.com/sstephenson/bats.git

https://github.com/theforeman/foreman-bats.git

https://raw.github.com/theforeman/foreman-bats/master/bootstrap.sh

I then see AVC denial

type=SYSCALL msg=audit(1400573528.296:205): arch=c000003e syscall=2 success=yes exit=8 a0=8a351a0 a1=90800 a2=8a35100 a3=2 items=0 ppid=32008 pid=32011 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1400573528.296:205): avc: denied { read } for pid=32011 comm="ruby" name="migrate" dev=dm-0 ino=661342 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file

after restart of Apache.

Associated revisions

Revision fcc3110b
Added by Lukas Zapletal over 3 years ago

Fixes #5808 - Allowed rails to read symlinks

History

#1 Updated by Dominic Cleal over 3 years ago

  • Project changed from Foreman to SELinux

#2 Updated by Lukas Zapletal over 3 years ago

  • Category set to Packaging
  • Status changed from New to Ready For Testing
  • Assigned To set to Lukas Zapletal
  • Target version set to Sprint 24

Rails reads all files in scripts/ subdirectory and since migrate is symlink and symlinks were not allowed by our rules, this fails.

I am changing to more opened admin_pattern which is safe in this context:

define(`admin_pattern',`
        manage_dirs_pattern($1,$2,$2)
        manage_files_pattern($1,$2,$2)
        manage_lnk_files_pattern($1,$2,$2)
        manage_fifo_files_pattern($1,$2,$2)
        manage_sock_files_pattern($1,$2,$2)

        relabel_dirs_pattern($1,$2,$2)
        relabel_files_pattern($1,$2,$2)
        relabel_lnk_files_pattern($1,$2,$2)
        relabel_fifo_files_pattern($1,$2,$2)
        relabel_sock_files_pattern($1,$2,$2)
')

https://github.com/theforeman/foreman-selinux/pull/18

#3 Updated by Dominic Cleal over 3 years ago

  • Release set to 1.5.1

#4 Updated by Anonymous over 3 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#5 Updated by Bryan Kearney over 3 years ago

  • Bugzilla link set to https://bugzilla.redhat.com/show_bug.cgi?id=1107684

Also available in: Atom PDF