Pulp

Background on the design:

Starting in 2.8.0 inbound content requests for RPM are rewritten using this rewrite rule[0]. That rewrite causes the platform httpd.conf file[1] match the inbound request against the content.wsgi apache WSGI handler which sends the request into the "content" Django application which is provided by Pulp platform and written by Pulp. The content.wsgi app url matches against this urls.py[2] handler which because of the url rewriting routes the request to this view code[3]. That[3] view code is where the logic lives that either uses XSendFile or issues the redirect.

I believe the problem is specifically right here[4]. That is where the symlink is being treated as if it is outside of /var/lib/pulp/content which for security purposes must be enforced. Without enforcing that you could ask Pulp to serve any file it had POSIX and SELinux read access to.

[0]: https://github.com/pulp/pulp_rpm/blob/dfaffec54b6b4834ef6d0ec52354a38fd779fedf/plugins/etc/httpd/conf.d/pulp_rpm.conf#L21-L32
[1]: https://github.com/pulp/pulp/blob/73b813b6c2ce682708f9386d71a29393e6d8fe77/server/etc/httpd/conf.d/pulp_content.conf
[2]: https://github.com/pulp/pulp/blob/328f4a4860866a7c090ce07834210ad549acb8d7/server/pulp/server/content/web/urls.py
[3]: https://github.com/pulp/pulp/blob/9af1dcf077baac3d9969e0e8621c44b3e4fb37a0/server/pulp/server/content/web/views.py
[4]: https://github.com/pulp/pulp/blob/9af1dcf077baac3d9969e0e8621c44b3e4fb37a0/server/pulp/server/content/web/views.py#L154-L158