Pulp

This bug is related to another selinux BZ.

https://bugzilla.redhat.com/show_bug.cgi?id=1158169

+ This comment was cloned from Bugzilla #1193794 comment 1 +

I have an F20 box with following packages installed:

pulp-selinux.noarch 2.6.0-0.5.beta.fc20 @pulp-2.6-testing
pulp-server.noarch 2.6.0-0.5.beta.fc20 @pulp-2.6-testing

Here are the labels I am seeing for the celerybeat.pid

[root@pulp-f-20 celery]# ls laZ
drwxr-xr-x. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 .
drwxr-xr-x. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 ..
-rw-r--r-. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 celerybeat.pid

+ This comment was cloned from Bugzilla #1193794 comment 2 +

Based on the labels dkliban provided, this does look like a real bug. I see the pid file has httpd_sys_rw_content_t, but it should not have that label.

lzap, two questions for you (or anyone)

1) What label do you expect? Is var_lib_t the right one?

2) Is the right way to fix this with a policy change, or is it an adjustment of this rule [0]?

[0]: https://github.com/pulp/pulp/blob/master/server/selinux/server/pulp-server.fc#L6

+ This comment was cloned from Bugzilla #1193794 comment 3 +

My only expectation is that restorecon does not actually restore. The fix would be to either modify .fc file contexts or to setup a file transition to drop the file with expected label.

On the Fedora box, try to run the restorecon to see what it does.

+ This comment was cloned from Bugzilla #1193794 comment 4 +

On my fedora box restorecon didn't change anything. The same labels remain.

+ This comment was cloned from Bugzilla #1193794 comment 5 +

Guys, sorry I should clarify this earlier. This is RHEL 7.0. Btw this is low priority - Pulp is operating properly. Cosmetic issue.

+ This comment was cloned from Bugzilla #1193794 comment 6 +