Project

Profile

Help

Issue #1730

SELinux prevents streamer from starting if 'gcc' is installed

Added by bmbouter about 5 years ago. Updated about 2 years ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
High
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
3. High
Version:
Platform Release:
2.8.0
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

Have an up-to-date EL6 machine with gcc installed and SELinux enforcing. Then attempt to start the streamer with:

sudo service pulp_streamer start

The streamer will not start, and you'll receive a traceback similar to:

[root@rhel6-vanilla-np-qeos-78533 pulp]# service pulp_streamer start
Starting pulp_streamer...
/usr/lib/python2.6/site-packages/pulp/server/db/connection.py:159: DeprecationWarning: add_son_manipulator is deprecated
  _DATABASE.add_son_manipulator(NamespaceInjector())
/usr/lib/python2.6/site-packages/pulp/server/db/model/base.py:96: DeprecationWarning: ensure_index is deprecated. Use create_index instead.
  unique=unique, background=True)
Traceback (most recent call last):
  File "/usr/lib64/python2.6/site-packages/twisted/application/app.py", line 694, in run
    runApp(config)
  File "/usr/lib64/python2.6/site-packages/twisted/scripts/twistd.py", line 23, in runApp
    _SomeApplicationRunner(config).run() 
  File "/usr/lib64/python2.6/site-packages/twisted/application/app.py", line 411, in run
    self.application = self.createOrGetApplication()
  File "/usr/lib64/python2.6/site-packages/twisted/application/app.py", line 494, in createOrGetApplication
    application = getApplication(self.config, passphrase)
--- <exception caught here> ---
  File "/usr/lib64/python2.6/site-packages/twisted/application/app.py", line 505, in getApplication
    application = service.loadApplication(filename, style, passphrase)
  File "/usr/lib64/python2.6/site-packages/twisted/application/service.py", line 390, in loadApplication
    application = sob.loadValueFromFile(filename, 'application', passphrase)
  File "/usr/lib64/python2.6/site-packages/twisted/persisted/sob.py", line 215, in loadValueFromFile
    exec fileObj in d, d
  File "/usr/share/pulp/wsgi/streamer.tac", line 56, in <module>
    manager_factory.initialize()
  File "/usr/lib/python2.6/site-packages/pulp/server/managers/factory.py", line 349, in initialize
    from pulp.server.managers.consumer.agent import AgentManager
  File "/usr/lib/python2.6/site-packages/pulp/server/managers/consumer/agent.py", line 18, in <module>
    from pulp.server.agent.context import Context
  File "/usr/lib/python2.6/site-packages/pulp/server/agent/context.py", line 18, in <module>
    from pulp.server.agent.direct.services import ReplyHandler
  File "/usr/lib/python2.6/site-packages/pulp/server/agent/direct/services.py", line 6, in <module>
    from gofer.rmi.async import ReplyConsumer, Listener
  File "/usr/lib/python2.6/site-packages/gofer/rmi/async.py", line 24, in <module>
    from gofer.rmi.dispatcher import Reply, Return, RemoteException
  File "/usr/lib/python2.6/site-packages/gofer/rmi/dispatcher.py", line 27, in <module>
    from gofer.pam import authenticate as pam_authenticate
  File "/usr/lib/python2.6/site-packages/gofer/pam.py", line 28, in <module>
    libc = CDLL(find_library('c'))
  File "/usr/lib64/python2.6/ctypes/util.py", line 209, in find_library
    return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
  File "/usr/lib64/python2.6/ctypes/util.py", line 93, in _findLib_gcc
    fdout, ccout = tempfile.mkstemp()
  File "/usr/lib64/python2.6/tempfile.py", line 286, in mkstemp
    dir = gettempdir()
  File "/usr/lib64/python2.6/tempfile.py", line 254, in gettempdir
    tempdir = _get_default_tempdir()
  File "/usr/lib64/python2.6/tempfile.py", line 201, in _get_default_tempdir
    ("No usable temporary directory found in %s" % dirlist))
exceptions.IOError: [Errno 2] No usable temporary directory found in ['/tmp', '/var/tmp', '/usr/tmp', '/var/www']

Failed to load application: [Errno 2] No usable temporary directory found in ['/tmp', '/var/tmp', '/usr/tmp', '/var/www']

OK

History

#1 Updated by bmbouter about 5 years ago

After discussion w/ jortel, the proposed adjustment is in gofer. The idea is to move all of the import time statements in pam.py[0] to a guarded function called _pam_initialize() which will be called exactly once upon the first call to authenticate[1].

A test of the viability was done on a machine that showed the issue in the first place. pam.py was modified to remove all code except authenticate() which performed a no-op. With this change and SELinux enforcing the streamer starts normally as expected.

[0]: https://github.com/jortel/gofer/blob/b4d47d770cdcd4e457cdeb07c8780abb1dd000bd/src/gofer/pam.py
[1]: https://github.com/jortel/gofer/blob/b4d47d770cdcd4e457cdeb07c8780abb1dd000bd/src/gofer/pam.py#L111

#2 Updated by jortel@redhat.com about 5 years ago

  • Status changed from NEW to ASSIGNED
  • Assignee set to jortel@redhat.com

#3 Updated by jortel@redhat.com about 5 years ago

Fixed in gofer 2.7.5 upstream. Available here: https://copr.fedorainfracloud.org/coprs/jortel/gofer/ and will get built in Fedora updates and koji ASAP.

#4 Updated by jortel@redhat.com about 5 years ago

gofer-2.7.5-1 built in koji.

#5 Updated by mhrivnak about 5 years ago

  • Triaged changed from No to Yes

#6 Updated by jortel@redhat.com about 5 years ago

  • Status changed from ASSIGNED to MODIFIED
  • Triaged changed from Yes to No

#8 Updated by dkliban@redhat.com about 5 years ago

  • Status changed from MODIFIED to 5

#9 Updated by mhrivnak about 5 years ago

  • Triaged changed from No to Yes

#10 Updated by dkliban@redhat.com about 5 years ago

  • Status changed from 5 to CLOSED - CURRENTRELEASE

#11 Updated by bmbouter about 2 years ago

  • Tags Pulp 2 added

Please register to edit this issue

Also available in: Atom PDF