Project

General

Profile

Bug #23700

Templates plugin disallowed to create symlinks

Added by Lukas Zapletal 3 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Category:
General Foreman
Target version:
Difficulty:
Triaged:
Bugzilla link:
Team Backlog:
Fixed in Releases:
Found in Releases:

Description

When I run the command to import my templates from git I get an SELinux denial:

type=PROCTITLE msg=audit(1526982093.115:5964): proctitle=67697400636C6F6E65002D2D007373683A2F2F676974406769746875622E636F6D2F67676174776172642F47475F4B69636B73746172742E676974002F746D702F6432303138303532322D33313436362D337375657972
type=SYSCALL msg=audit(1526982093.115:5964): arch=c000003e syscall=88 success=no exit=-13 a0=518ccd a1=7817e0 a2=180 a3=7fff05e22ea0 items=0 ppid=15768 pid=15769 auid=4294967295 uid=991 gid=989 euid=991 suid=991 fsuid=991 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm="git" exe="/usr/bin/git" subj=system_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1526982093.115:5964): avc: denied { create } for pid=15769 comm="git" name="tCZtgIQ" scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:passenger_tmp_t:s0 tclass=lnk_file

When running with audit2allow the following policy te is created:

module my-git 1.0;

require {
type passenger_tmp_t;
type passenger_t;
class lnk_file { create getattr unlink };
}

#============= passenger_t ==============
allow passenger_t passenger_tmp_t:lnk_file { create getattr unlink };

Associated revisions

Revision eff5e6b4 (diff)
Added by Lukas Zapletal 3 months ago

Fixes #23700 - passenger/http can manage symlinks

History

#1 Updated by The Foreman Bot 3 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman-selinux/pull/81 added

#2 Updated by Lukas Zapletal 3 months ago

  • Bugzilla link set to 1582410

#3 Updated by Lukas Zapletal 3 months ago

  • Legacy Backlogs Release (now unused) set to 330

#4 Updated by Anonymous 3 months ago

  • % Done changed from 0 to 100
  • Status changed from Ready For Testing to Closed

#5 Updated by Anonymous about 1 month ago

  • Target version deleted (1.18.0)

Also available in: Atom PDF