Issue #388
closedpulp-qpid-ssl-cfg doesn't set correct selinux permissions for generated certs
Description
audit log filtered for qpidd denials
Version-Release number of selected component (if applicable):
pulp-2.3
How reproducible:
Always
Steps to Reproduce:
follow https://pulp-user-guide.readthedocs.org/en/pulp-2.3/qpid.html#qpid-ssl-configuration
Actual results:
blocked qpidd openssl config
Expected results:
Additional info:
- see AVC denials in attached log file
+ This bug was cloned from Bugzilla Bug #1039637 +
Files
Updated by mkovacik@redhat.com about 8 years ago
- Investigating the avc details, following are affected files:
[root@ec2-54-216-182-120 ~]# inums=( `grepi avc /var/log/audit/audit.log | grep qpidd | sed -e 's,.*ino=\([^\s]*\).*,\1,' | sort | uniq` ). root root system_u:object_r:passwd_file_t:s0 /etc/group
[root@ec2-54-216-182-120 ~]# for inum in ${inums[@]} ; do find / -inum $inum -exec ls -lZd {} \; ; done
-rw-r--r-
drwxr-xr-x. apache apache system_u:object_r:pulp_cert_t:s0 /etc/pki/pulp
drwxr-xr-x. root root unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid
rw-r----. root qpidd unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid/nss/secmod.db
rw-r----. root qpidd unconfined_u:object_r:pulp_cert_t:s0 /etc/pki/pulp/qpid/nss/password
rw-r--r-. root root system_u:object_r:passwd_file_t:s0 /etc/passwd
+ This comment was cloned from Bugzilla #1039637 comment 1 +
Updated by skarmark@redhat.com about 8 years ago
Update documentation to run selinux commands to update file contexts for the certs.
+ This comment was cloned from Bugzilla #1039637 comment 2 +
Updated by bmbouter almost 7 years ago
- Parent task set to #1826
- Severity set to 1. Low
Updated by bmbouter almost 4 years ago
- Status changed from NEW to CLOSED - WONTFIX
Updated by bmbouter almost 4 years ago
Pulp 2 is approaching maintenance mode, and this Pulp 2 ticket is not being actively worked on. As such, it is being closed as WONTFIX. Pulp 2 is still accepting contributions though, so if you want to contribute a fix for this ticket, please reopen or comment on it. If you don't have permissions to reopen this ticket, or you want to discuss an issue, please reach out via the developer mailing list.