Project

General

Profile

Actions
Copy link

Bug #6283

closed

Katello ping controller executes init scripts

Added by Dominic Cleal over 10 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Ivan Necas
Category:
API
Target version:
Katello 2.0
Difficulty:
medium
Triaged:
Yes
Bugzilla link:
1105085
Pull request:
https://github.com/Katello/katello/pull/4564
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1105085
Model class app/models/katello/ping.rb executes /etc/init.d/katello-jobs. This is security concern.

I am allowing this in our SELinux policy for now, because katello-jobs service will be removed for GA and it will be replaced by dynflow engine. All other services are checked with their API, I expect the same for dynflow so no services are needed to be executed at all.

Please remove this exec for GA once dynflow engine replace katello-jobs. Once this task is done, please raise a BZ on SELinux component to remove the rules.

PM: Please waive this for GA not Beta.

Related issues 2 (0 open — 2 closed)

Blocks SELinux - Refactor #6284: Remove Passenger/init_exec_script_files policyClosedActions
Blocked by Katello - Refactor #6297: Remove katello-jobsClosedIvan Necas06/19/2014Actions
Actions
Copy link

Also available in: Atom PDF