Activity
From 05/14/2014 to 06/12/2014
06/12/2014
-
03:29 PM Bug #6192: Policy prevents from libvirt qemu+ssh connection
- Warning for myself - I had semanage -DB enabled.
-
- With SELinux turned on in Enforcing, one is not able to reach qemu+ssh libvirt instance....
-
- Reproduced with:...
-
- I was able to identify the ssh_exec issue and reported it under http://projects.theforeman.org/issues/6192
Now, tu... -
11:47 AM Bug #6162: "WebSock error: [object Event]"
- I already have the latest foreman-selinux installed and "setenforce 0" works and "setenforce 1" fails consistently wi...
-
- Hello,
thanks for testing. Can you install foreman-selinux from nightly repo (you can mix and match this package w... -
- Sorry didn't have my first coffee yet, it worked because I switched of SELinux .... duh!
When I do setenforce 0, t... -
- I updated to 1.6 nightly to get around some other bugs and it works now. I'll revert back to 1.5 stable later in the ...
-
- Jorick, can you please tail -f the audit.log and then try to access the console. Paste me those lines which are added...
-
- Hello,
I don't see any denials that have something to do with our VNC proxy. Can you do this for me:
ps aux...
06/11/2014
-
- Forgot to add that I'm running version "foreman-1.5.0-1.el6.noarch"
-
- After hooking up a libvirt server to foreman I'm unable to access the
VNC console. I already checked everything fro...
06/10/2014
-
09:54 PM Feature #5870: Write policy for foreman-tasks
- As installer support's landing in 1.5.1 too.
-
- https://github.com/theforeman/foreman-selinux/pull/21
Note for myself: there are two downstream bugzillas for this...
06/09/2014
-
- #============= logrotate_t ==============
files_manage_urandom_seed(logrotate_t)
#============= passenger_t =====... -
- Installed, then executed foreman-debug:...
06/05/2014
-
- OSP guys rely on this feature, boosting priority: https://bugzilla.redhat.com/show_bug.cgi?id=1105154
-
- Combined two BZs into this ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1084013
-
- Another set of denials:...
06/02/2014
-
- foreman-selinux-1.6.0-0.develop.201405301314git8ad6a63.el7.noarch
mod_passenger-4.0.18-9.5.el7.x86_64
puppet-3.6.0-... -
- foreman-selinux-1.6.0-0.develop.201405301314git8ad6a63.el7.noarch
redhat-release-server-7.0-0.5.el7.x86_64
selinux-...
05/30/2014
-
-
10:47 AM
Bug #5827 (Closed): katello-installer generates AVC: denied { name_connect } for scontext=passenger_t:s0 tcontext=:websm_port_t:s0 tclass=tcp_socket
- Applied in changeset commit:b13ec514c1616dcea4ba90f3c6794827d9957db5.
-
10:47 AM
Bug #5910 (Closed): Puppet or puppetmaster sometimes changes file contexts
- Applied in changeset commit:a39d8de2e0ab1f042acb21e446773d7d8496d25e.
-
10:47 AM
Bug #5808 (Closed): AVC denied { read } for comm="ruby" name="migrate" dev=dm-0 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file
- Applied in changeset commit:fcc3110b4a1d7eb70f17cd6d61bcbc329c0ebb70.
-
10:47 AM
Feature #5870 (Closed): Write policy for foreman-tasks
- Applied in changeset commit:9554703f49b74891f36146bd430069d0e3c12bbe.
- 09:42 AM Revision b13ec514: Fixes #5827 - Allowed port 9090 and new foreman_proxy_port_t introduced
- 09:37 AM Revision a39d8de2: Fixes #5910 - Puppetmaster allowed to set file contexts
- 09:37 AM Revision fcc3110b: Fixes #5808 - Allowed rails to read symlinks
- 09:37 AM Revision 9554703f: Fixes #5870 - Foreman-tasks selinux policy added
05/29/2014
-
- And another run:
type=AVC msg=audit(1401367752.666:1209): avc: denied { name_bind } for pid=16698 comm="rub... -
- Staypuft installer:...
-
05/27/2014
-
- I agree, if we find this annoying, I will work on splitting all the policies. But I hope for 5 lines for Katello, the...
-
- Ok, see what it involves, but my concern is if changes are needed regularly in a core Foreman project to support a pl...
-
- Why? Katello is a plugin, like others. There is no big benefit in splitting those.
Also, I don't expect katello po... -
- This should be a layered policy (katello-selinux), not in foreman-selinux.
05/26/2014
-
- Some rules can be taken from katello-selinux package.
-
- https://github.com/theforeman/foreman-selinux/pull/18
-
- That sounds like a decent plan, but unfortunately port 9090 is already taken by websm service (no clue what this is)....
-
- Solved with great help of Mirek Grepl, thanks.
https://github.com/theforeman/foreman-selinux/pull/18 -
- Rails reads all files in scripts/ subdirectory and since migrate is symlink and symlinks were not allowed by our rule...
05/23/2014
-
- ...
-
- which is prevented by SELinux. This has something to do with selinux users and RHEL6. Discussion is here:...
-
-
- https://github.com/theforeman/foreman-selinux/pull/18 (not yet merged)
-
- We need tasks policy really, testing that.
05/22/2014
-
- ...
-
- https://github.com/theforeman/foreman-selinux/pull/17
-
- Hotfix for https://bugzilla.redhat.com/show_bug.cgi?id=1098244
-
- Also there is one block "passenger_run_puppetmaster" which we can refactor/get rid of only after we migrate foreman i...
-
- Since Passenger 4.0 which allows us to change context of running apps is now both upstream and downstream, we should ...
-
- Blocker for Staypuft. Working on it from the very morning.
https://bugzilla.redhat.com/show_bug.cgi?id=1098244
05/20/2014
-
- The issue looks to be that katello-installer has moved the smart proxy port from 8443 to 9090, so the default policy ...
-
- Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1078265
Description of problem:
katello-installer generat... -
08:29 AM Bug #5808 (Closed): AVC denied { read } for comm="ruby" name="migrate" dev=dm-0 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:foreman_lib_t:s0 tclass=lnk_file
- With fresh install of Foreman develop on RHEL 6.5 using
https://github.com/sstephenson/bats.git
https://github....
Also available in: Atom