Foreman » SELinux

Hey thanks for the report, I am unable to confirm with nightly. Can you please give me:

ps auxZwww

Hi Lukas

Here you go, let me know if you need any thing else

http://paste.fedoraproject.org/97812/98782278/

Ok this explains everything. Both puppet master and foreman are running in wrong domain httpd_t instead of passenger_t.

Can you please now pastebin the following (versions of the RPM packages or in directories might be slightly different):

[root@nightly ~]# rpm -qa | grep passenger
rubygem-passenger-native-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-native-libs-4.0.18-9.4.el6.x86_64
rubygem-passenger-native-libs-4.0.18-9.4.el6.x86_64
mod_passenger-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-native-4.0.18-9.4.el6.x86_64
rubygem-passenger-4.0.18-9.4.el6.x86_64
[root@nightly ~]# rpm -ql ruby193-rubygem-passenger-native
/etc/logrotate.d/ruby193-passenger
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerHelperAgent
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerLoggingAgent
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerWatchdog
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/SpawnPreparer
/opt/rh/ruby193/root/var/log/passenger-analytics
[root@nightly ~]# rpm -ql rubygem-passenger-native
/etc/logrotate.d/passenger
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerHelperAgent
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerLoggingAgent
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerWatchdog
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/SpawnPreparer
/var/log/passenger-analytics
[root@nightly ~]# ls /opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents -Z
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerHelperAgent
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerLoggingAgent
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerWatchdog
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 SpawnPreparer
[root@nightly ~]# ls /usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents -Z
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerHelperAgent
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerLoggingAgent
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 PassengerWatchdog
-rwxr-xr-x. root root system_u:object_r:passenger_exec_t:s0 SpawnPreparer

Also show me your SELinux policy and foreman policy version numbers and then paste me output of our file context:

[root@nightly ~]# rpm -q selinux-policy foreman-selinux
selinux-policy-3.7.19-231.el6.noarch
foreman-selinux-1.6.0-0.develop.201404281258git0e094fe.el6.noarch
[root@nightly ~]# cat /usr/share/doc/foreman-selinux-1.6.0/foreman.fc

Hi Lukas

rubygem-passenger-4.0.18-9.4.el6.x86_64
rubygem-passenger-native-4.0.18-9.4.el6.x86_64
mod_passenger-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-4.0.18-9.4.el6.x86_64
rubygem-passenger-native-libs-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-native-libs-4.0.18-9.4.el6.x86_64
ruby193-rubygem-passenger-native-4.0.18-9.4.el6.x86_64
/etc/logrotate.d/ruby193-passenger
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerHelperAgent
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerLoggingAgent
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/PassengerWatchdog
/opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents/SpawnPreparer
/opt/rh/ruby193/root/var/log/passenger-analytics
/etc/logrotate.d/passenger
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerHelperAgent
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerLoggingAgent
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/PassengerWatchdog
/usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents/SpawnPreparer
/var/log/passenger-analytics

-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerHelperAgent
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerLoggingAgent
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerWatchdog
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 SpawnPreparer

-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerHelperAgent
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerLoggingAgent
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 PassengerWatchdog
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 SpawnPreparer

selinux-policy-3.7.19-231.el6_5.1.noarch
foreman-selinux-1.5.0-0.2.RC2.el6.noarch

Confirmed, strange, foreman-selinux should relabel during installation automatically. Can you do:

1. foreman-selinux-relabel

Then check the labels and if these were fixed you can set enforcing back and restart apache.

1. ls /opt/rh/ruby193/root/usr/lib64/gems/exts/passenger-4.0.18/agents -Z
2. ls /usr/lib64/ruby/site_ruby/1.8/x86_64-linux/agents -Z

Is it possible you installed/upgraded the instance when SELinux was turned off? In that case, relabel is not initiated.

My server runs in Enforcing, in fact puppet makes sure it is always in enforcing :-D

OK, ran the relabel and restarted 8and rebooted) still doesnt run unless Im in permissive mode

Lukas Zapletal wrote:

Confirmed, strange, foreman-selinux should relabel during installation automatically. Can you do:

1. foreman-selinux-relabel

I have the same problem and running the above outputs info about fixing /etc/foreman folders but not /opt/rh/ruby193/root/user/lib64/...

My foreman-selinux is version 1.5.0-0.2.RC2.el6 while you refer to 1.6.0.

Joop

thanks a lot, that works perfectly, Im now back in Enforcing mode :D

Thanks for confirming!