{"action":"created","issue":{"url":"https://api.github.com/repos/pulp/pulp/issues/2784","repository_url":"https://api.github.com/repos/pulp/pulp","labels_url":"https://api.github.com/repos/pulp/pulp/issues/2784/labels{/name}","comments_url":"https://api.github.com/repos/pulp/pulp/issues/2784/comments","events_url":"https://api.github.com/repos/pulp/pulp/issues/2784/events","html_url":"https://github.com/pulp/pulp/pull/2784","id":182368477,"number":2784,"title":"Fix AVC denials while restoring SELinux context as part of publishing.","user":{"login":"jortel","id":1126767,"avatar_url":"https://avatars.githubusercontent.com/u/1126767?v=3","gravatar_id":"","url":"https://api.github.com/users/jortel","html_url":"https://github.com/jortel","followers_url":"https://api.github.com/users/jortel/followers","following_url":"https://api.github.com/users/jortel/following{/other_user}","gists_url":"https://api.github.com/users/jortel/gists{/gist_id}","starred_url":"https://api.github.com/users/jortel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jortel/subscriptions","organizations_url":"https://api.github.com/users/jortel/orgs","repos_url":"https://api.github.com/users/jortel/repos","events_url":"https://api.github.com/users/jortel/events{/privacy}","received_events_url":"https://api.github.com/users/jortel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-11T20:40:27Z","updated_at":"2016-10-12T21:25:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pulp/pulp/pulls/2784","html_url":"https://github.com/pulp/pulp/pull/2784","diff_url":"https://github.com/pulp/pulp/pull/2784.diff","patch_url":"https://github.com/pulp/pulp/pull/2784.patch"},"body":"https://pulp.plan.io/issues/2326\r\nhttps://pulp.plan.io/issues/2277\r\n\r\nWhile reproducing this issue, the relabeling during publishing was failing with permission denied.\r\n\r\nFound this:\r\n```\r\n[jortel@f23s ~]$ sudo audit2allow -Ral\r\n\r\nrequire {\r\n\ttype celery_t;\r\n}\r\n\r\n#============= celery_t ==============\r\nselinux_set_enforce_mode(celery_t)\r\nselinux_validate_context(celery_t)\r\n```\r\n\r\nAfter adding these 2 rules to the policy and installing, the publish succeeded and GET on files worked:\r\n\r\n```\r\n[jortel@f23s ~]$ sudo setenforce 1\r\n\r\n[jortel@f23s ~]$ pulp-admin rpm repo sync run --repo-id=zoo \r\n+----------------------------------------------------------------------+\r\n                     Synchronizing Repository [zoo]\r\n+----------------------------------------------------------------------+\r\n\r\nThis command may be exited via ctrl+c without affecting the request.\r\n\r\nDownloading metadata...\r\n[\\]\r\n... completed\r\n\r\nDownloading repository content...\r\n[-]\r\n[==================================================] 100%\r\nRPMs:       0/0 items\r\nDelta RPMs: 0/0 items\r\n\r\n... completed\r\n\r\nDownloading distribution files...\r\n[==================================================] 100%\r\nDistributions: 0/0 items\r\n... completed\r\n\r\nImporting errata...\r\n[-]\r\n... completed\r\n\r\nImporting package groups/categories...\r\n[-]\r\n... completed\r\n\r\nCleaning duplicate packages...\r\n[-]\r\n... completed\r\n\r\nTask Succeeded\r\n\r\nTask Succeeded\r\n```\r\n\r\n```\r\n[jortel@f23s ~]$  wget --no-check-certificate https://f23s.redhat.com/pulp/repos/repos/pulp/pulp/fixtures/rpm/bear-4.1-1.noarch.rpm\r\n--2016-10-11 15:25:15--  https://f23s.redhat.com/pulp/repos/repos/pulp/pulp/fixtures/rpm/bear-4.1-1.noarch.rpm\r\nResolving f23s.redhat.com (f23s.redhat.com)... 192.168.122.170\r\nConnecting to f23s.redhat.com (f23s.redhat.com)|192.168.122.170|:443... connected.\r\nWARNING: cannot verify f23s.redhat.com's certificate, issued by ‘CN=f23s.redhat.com,O=Default Company Ltd,L=Default City,C=XX’:\r\n  Self-signed certificate encountered.\r\nHTTP request sent, awaiting response... 200 OK\r\n```"},"comment":{"url":"https://api.github.com/repos/pulp/pulp/issues/comments/253344327","html_url":"https://github.com/pulp/pulp/pull/2784#issuecomment-253344327","issue_url":"https://api.github.com/repos/pulp/pulp/issues/2784","id":253344327,"user":{"login":"bmbouter","id":180319,"avatar_url":"https://avatars.githubusercontent.com/u/180319?v=3","gravatar_id":"","url":"https://api.github.com/users/bmbouter","html_url":"https://github.com/bmbouter","followers_url":"https://api.github.com/users/bmbouter/followers","following_url":"https://api.github.com/users/bmbouter/following{/other_user}","gists_url":"https://api.github.com/users/bmbouter/gists{/gist_id}","starred_url":"https://api.github.com/users/bmbouter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmbouter/subscriptions","organizations_url":"https://api.github.com/users/bmbouter/orgs","repos_url":"https://api.github.com/users/bmbouter/repos","events_url":"https://api.github.com/users/bmbouter/events{/privacy}","received_events_url":"https://api.github.com/users/bmbouter/received_events","type":"User","site_admin":false},"created_at":"2016-10-12T21:25:40Z","updated_at":"2016-10-12T21:25:40Z","body":"@jortel Does syncing zoo use the \"move\" codepath? I thought we only added that in one place for docker maybe."}}
{"actor":{"display_login":"bmbouter"}}