Project

Profile

Help

Issue #1764

closed

SELinux denial on Celery attempting to read resolv.conf

Added by rbarlow over 8 years ago. Updated about 5 years ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
High
Assignee:
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
3. High
Version:
Master
Platform Release:
2.8.3
OS:
Fedora Rawhide
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

It seems that we are missing an SELinux permission and are being denied read access on the resolv.conf file:

type=AVC msg=audit(1457559807.664:2336): avc:  denied  { read } for  pid=4876 comm="celery" name="resolv.conf" dev="dm-0" ino=261406 scontext=system_u:system_r:celery_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=lnk_file permissive=0

audit2allow recommends this policy change:

$ sudo audit2allow -al

#============= celery_t ==============
allow celery_t net_conf_t:lnk_file read;

Also available in: Atom PDF