{"action":"created","issue":{"url":"https://api.github.com/repos/processone/ejabberd/issues/1375","repository_url":"https://api.github.com/repos/processone/ejabberd","labels_url":"https://api.github.com/repos/processone/ejabberd/issues/1375/labels{/name}","comments_url":"https://api.github.com/repos/processone/ejabberd/issues/1375/comments","events_url":"https://api.github.com/repos/processone/ejabberd/issues/1375/events","html_url":"https://github.com/processone/ejabberd/issues/1375","id":188422555,"number":1375,"title":"certfile seems to be opened with write mode","user":{"login":"bowlofeggs","id":354506,"avatar_url":"https://avatars.githubusercontent.com/u/354506?v=3","gravatar_id":"","url":"https://api.github.com/users/bowlofeggs","html_url":"https://github.com/bowlofeggs","followers_url":"https://api.github.com/users/bowlofeggs/followers","following_url":"https://api.github.com/users/bowlofeggs/following{/other_user}","gists_url":"https://api.github.com/users/bowlofeggs/gists{/gist_id}","starred_url":"https://api.github.com/users/bowlofeggs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bowlofeggs/subscriptions","organizations_url":"https://api.github.com/users/bowlofeggs/orgs","repos_url":"https://api.github.com/users/bowlofeggs/repos","events_url":"https://api.github.com/users/bowlofeggs/events{/privacy}","received_events_url":"https://api.github.com/users/bowlofeggs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-10T05:20:49Z","updated_at":"2016-11-10T19:15:35Z","closed_at":null,"body":"> What version of ejabberd are you using?\r\n\r\nejabberd-16.08-2.fc25.x86_64\r\n\r\n\r\n> What operating system (version) are you using?\r\n\r\nFedora 25 (pre-release)\r\n\r\n\r\n> How did you install ejabberd (source, package, distribution)?\r\n\r\ndistribution\r\n\r\n\r\n> What did not work as expected? Are there error messages in the log? What\r\n> was the unexpected behavior? What was the expected result?\r\n\r\nHello! I am one of the ejabberd maintainers for Fedora, and I've been working on a mission to get it running with a restricted SELinux context. One of the AVC denials I'm seeing are due to ejabberd attempting to open my certfile with write mode:\r\n\r\n```\r\ntype=AVC msg=audit(1478751171.862:648): avc:  denied  { write } for  pid=2989 comm=\"async_2\" name=\"ejabberd.pem\" dev=\"dm-1\" ino=44546 scontext=system_u:system_r:rabbitmq_t:s0 tcontext=unconfined_u:object_r:etc_t:s0 tclass=file permissive=0\r\ntype=AVC msg=audit(1478751171.863:649): avc:  denied  { write } for  pid=2989 comm=\"async_2\" name=\"ejabberd.pem\" dev=\"dm-1\" ino=44546 scontext=system_u:system_r:rabbitmq_t:s0 tcontext=unconfined_u:object_r:etc_t:s0 tclass=file permissive=0\r\n```\r\n\r\nI don't believe ejabbed should need to write the certfile, so I would like to request that we adjust ejabberd to open the file in read mode. However, it's not obvious to be why ejabberd is opening the file in write mode (and I'm an Erlang noob). In what is a completely wild guess, it might be related to:\r\n\r\nhttps://github.com/processone/ejabberd/blob/16.08/src/ejabberd_listener.erl#L548\r\n\r\nwhich calls into:\r\n\r\nhttps://github.com/processone/ejabberd/blob/16.08/src/ejabberd_config.erl#L970-L980\r\n\r\nGoing further into my wild guessing game, is it perhaps trying to open the file in write mode just to see if it can, and then falling back to read? Or is the write open() happening somewhere else in the code?\r\n\r\nEither way, I'm happy to make a pull request to get this file opened in a read-only fashion if someone would be willing to point me in the right direction!"},"comment":{"url":"https://api.github.com/repos/processone/ejabberd/issues/comments/259780500","html_url":"https://github.com/processone/ejabberd/issues/1375#issuecomment-259780500","issue_url":"https://api.github.com/repos/processone/ejabberd/issues/1375","id":259780500,"user":{"login":"prefiks","id":61998,"avatar_url":"https://avatars.githubusercontent.com/u/61998?v=3","gravatar_id":"","url":"https://api.github.com/users/prefiks","html_url":"https://github.com/prefiks","followers_url":"https://api.github.com/users/prefiks/followers","following_url":"https://api.github.com/users/prefiks/following{/other_user}","gists_url":"https://api.github.com/users/prefiks/gists{/gist_id}","starred_url":"https://api.github.com/users/prefiks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prefiks/subscriptions","organizations_url":"https://api.github.com/users/prefiks/orgs","repos_url":"https://api.github.com/users/prefiks/repos","events_url":"https://api.github.com/users/prefiks/events{/privacy}","received_events_url":"https://api.github.com/users/prefiks/received_events","type":"User","site_admin":false},"created_at":"2016-11-10T19:15:35Z","updated_at":"2016-11-10T19:15:35Z","body":"It doesn't look like pem files are opened with write flag from what i see. I see that they are only opened with O_RDONLY flag, but there is call to access(name, W_OK) (that i guess file:read_file_info does) that maybe trigger this?"}}
{"actor":{"display_login":"prefiks"}}