Activity

From 04/30/2014 to 05/29/2014

01:02 PM Bug #5981: Passenger opens up udp port: And another run:
type=AVC msg=audit(1401367752.666:1209): avc: denied { name_bind } for pid=16698 comm="rub... Lukas Zapletal
12:24 PM Bug #5981 (Closed): Passenger opens up udp port: Staypuft installer:... Lukas Zapletal
10:10 AM Revision daeb2439: refs #5793 - add pkg:generate_source rake task to create tar.bz2: Dominic Cleal

10:27 AM Feature #5930: Implement policy for Katello plugin: I agree, if we find this annoying, I will work on splitting all the policies. But I hope for 5 lines for Katello, the... Lukas Zapletal
08:53 AM Feature #5930: Implement policy for Katello plugin: Ok, see what it involves, but my concern is if changes are needed regularly in a core Foreman project to support a pl... Dominic Cleal
08:52 AM Feature #5930: Implement policy for Katello plugin: Why? Katello is a plugin, like others. There is no big benefit in splitting those.
Also, I don't expect katello po... Lukas Zapletal
08:24 AM Feature #5930: Implement policy for Katello plugin: This should be a layered policy (katello-selinux), not in foreman-selinux. Dominic Cleal

02:39 PM Feature #5930 (Closed): Implement policy for Katello plugin: Some rules can be taken from katello-selinux package. Lukas Zapletal
01:42 PM Bug #5827 (Ready For Testing): katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket: https://github.com/theforeman/foreman-selinux/pull/18 Lukas Zapletal
01:38 PM Bug #5827: katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket: That sounds like a decent plan, but unfortunately port 9090 is already taken by websm service (no clue what this is).... Lukas Zapletal
11:26 AM Bug #5910 (Ready For Testing): Puppet or puppetmaster sometimes changes file contexts: Solved with great help of Mirek Grepl, thanks.
https://github.com/theforeman/foreman-selinux/pull/18 Lukas Zapletal
09:34 AM Bug #5808 (Ready For Testing): AVC denied { read } for comm="ruby" name="migrate" dev=dm-0 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file: Rails reads all files in scripts/ subdirectory and since migrate is symlink and symlinks were not allowed by our rule... Lukas Zapletal

01:14 PM Bug #5910: Puppet or puppetmaster sometimes changes file contexts: ... Lukas Zapletal
01:11 PM Bug #5910 (Closed): Puppet or puppetmaster sometimes changes file contexts: which is prevented by SELinux. This has something to do with selinux users and RHEL6. Discussion is here:... Lukas Zapletal
11:37 AM Bug #5827 (Assigned): katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket: Lukas Zapletal
11:12 AM Feature #5870 (Ready For Testing): Write policy for foreman-tasks: https://github.com/theforeman/foreman-selinux/pull/18 (not yet merged)
Lukas Zapletal
08:46 AM Bug #5882 (Rejected): Allow foreman to reach dynflow: We need tasks policy really, testing that. Lukas Zapletal

04:11 PM Bug #5882: Allow foreman to reach dynflow: ... Lukas Zapletal
04:04 PM Bug #5882 (Ready For Testing): Allow foreman to reach dynflow: https://github.com/theforeman/foreman-selinux/pull/17 Lukas Zapletal
03:47 PM Bug #5882 (Rejected): Allow foreman to reach dynflow: Hotfix for https://bugzilla.redhat.com/show_bug.cgi?id=1098244 Lukas Zapletal
12:12 PM Refactor #5877: Introduce foreman_t domain: Also there is one block "passenger_run_puppetmaster" which we can refactor/get rid of only after we migrate foreman i... Lukas Zapletal
12:06 PM Refactor #5877 (Closed): Introduce foreman_t domain: Since Passenger 4.0 which allows us to change context of running apps is now both upstream and downstream, we should ... Lukas Zapletal
11:00 AM Feature #5870 (Closed): Write policy for foreman-tasks: Blocker for Staypuft. Working on it from the very morning.
https://bugzilla.redhat.com/show_bug.cgi?id=1098244 Lukas Zapletal

03:22 PM Bug #5827: katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket: The issue looks to be that katello-installer has moved the smart proxy port from 8443 to 9090, so the default policy ... Dominic Cleal
03:20 PM Bug #5827 (Closed): katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket: Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1078265
Description of problem:
katello-installer generat... Dominic Cleal
08:29 AM Bug #5808 (Closed): AVC denied { read } for comm="ruby" name="migrate" dev=dm-0 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file: With fresh install of Foreman develop on RHEL 6.5 using
https://github.com/sstephenson/bats.git
https://github.... Jan Pazdziora

04:47 PM Bug #5487 (Closed): cant run with SELinix in enforcing after upgrade to 1.5RC2: Applied in changeset commit:b5f521e7b6514204772e627a63a1102ceb1546ec. Anonymous
04:33 PM Bug #5487: cant run with SELinix in enforcing after upgrade to 1.5RC2: Thanks for confirming! Dominic Cleal
04:28 PM Bug #5487: cant run with SELinix in enforcing after upgrade to 1.5RC2: thanks a lot, that works perfectly, Im now back in Enforcing mode :D Ade Bradshaw
02:50 PM Bug #5487 (Ready For Testing): cant run with SELinix in enforcing after upgrade to 1.5RC2: All right, found the bug. My bad. The patch is here:
https://github.com/theforeman/foreman-selinux/pull/16
Temp... Lukas Zapletal
01:30 PM Bug #5487: cant run with SELinix in enforcing after upgrade to 1.5RC2: Lukas Zapletal wrote:
> Confirmed, strange, foreman-selinux should relabel during installation automatically. Can yo... Joop van de Wege
12:39 PM Bug #5487: cant run with SELinix in enforcing after upgrade to 1.5RC2: My server runs in Enforcing, in fact puppet makes sure it is always in enforcing :-D
OK, ran the relabel and resta... Ade Bradshaw
09:15 AM Bug #5487: cant run with SELinix in enforcing after upgrade to 1.5RC2: Confirmed, strange, foreman-selinux should relabel during installation automatically. Can you do:
# foreman-se... Lukas Zapletal
04:32 PM Revision b5f521e7: fixes #5487 - fixed paths in selinux-relabel script: Lukas Zapletal

Also available in: Atom

Foreman » SELinux