-
Bug
-
Resolution: Done
-
Blocker
-
None
-
None
-
5
-
False
-
pulpcore-selinux-2.2.0
-
Satellite Rocket Sprint 7
-
sat-rocket
-
None
-
None
-
None
-
None
Description of problem:
Pulpcore 3.85 upgrade introduced SELinux denials in the nightly pipeline:
[2025-10-06T23:44:36.458Z] not ok 1 centos9-stream install: ensure no SELinux denials [2025-10-06T23:44:36.458Z] # (in test file fb-verify-selinux.bats, line 12) [2025-10-06T23:44:36.458Z] # `[ "${status}" -eq 1 ]' failed [2025-10-06T23:44:36.458Z] # $ [fb-verify-selinux.bats, line 9] [2025-10-06T23:44:36.458Z] # $ tIsRedHatCompatible [2025-10-06T23:44:36.458Z] # $$ [os_helper.bash, line 4] [2025-10-06T23:44:36.458Z] # $$ [[ -f /etc/redhat-release ]] [2025-10-06T23:44:36.458Z] # $ [fb-verify-selinux.bats, line 10] [2025-10-06T23:44:36.458Z] # $ run ausearch --message AVC [2025-10-06T23:44:36.458Z] # $ echo "$output" [2025-10-06T23:44:36.458Z] # ---- [2025-10-06T23:44:36.458Z] # time->Mon Oct 6 22:58:55 2025 [2025-10-06T23:44:36.458Z] # type=PROCTITLE msg=audit(1759791535.686:4684): proctitle=2F7573722F62696E2F707974686F6E332E3132002D7350002F7573722F62696E2F70756C70636F72652D776F726B6572 [2025-10-06T23:44:36.458Z] # type=SYSCALL msg=audit(1759791535.686:4684): arch=c000003e syscall=254 success=yes exit=1 a0=11 a1=7f75deb416ae a2=1000182 a3=8 items=0 ppid=39999 pid=48246 auid=4294967295 uid=990 gid=989 euid=990 suid=990 fsuid=990 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm="pulpcore-worker" exe="/usr/bin/python3.12" subj=system_u:system_r:pulpcore_t:s0 key=(null) [2025-10-06T23:44:36.458Z] # type=AVC msg=audit(1759791535.686:4684): avc: denied { watch } for pid=48246 comm="pulpcore-worker" path="/etc" dev="vda1" ino=524290 scontext=system_u:system_r:pulpcore_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 [2025-10-06T23:44:36.458Z] # ---- [2025-10-06T23:44:36.458Z] # time->Mon Oct 6 23:02:10 2025 [2025-10-06T23:44:36.458Z] # type=PROCTITLE msg=audit(1759791730.764:4704): proctitle=2F7573722F62696E2F707974686F6E332E3132002D7350002F7573722F62696E2F70756C70636F72652D776F726B6572 [2025-10-06T23:44:36.458Z] # type=SYSCALL msg=audit(1759791730.764:4704): arch=c000003e syscall=254 success=yes exit=1 a0=11 a1=7f75deb416ae a2=1000182 a3=8 items=0 ppid=39999 pid=49968 auid=4294967295 uid=990 gid=989 euid=990 suid=990 fsuid=990 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm="pulpcore-worker" exe="/usr/bin/python3.12" subj=system_u:system_r:pulpcore_t:s0 key=(null) [2025-10-06T23:44:36.458Z] # type=AVC msg=audit(1759791730.764:4704): avc: denied { watch } for pid=49968 comm="pulpcore-worker" path="/etc" dev="vda1" ino=524290 scontext=system_u:system_r:pulpcore_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 [2025-10-06T23:44:36.458Z] # ---- [2025-10-06T23:44:36.458Z] # time->Mon Oct 6 23:18:32 2025 [2025-10-06T23:44:36.458Z] # type=PROCTITLE msg=audit(1759792712.468:5864): proctitle=2F7573722F62696E2F707974686F6E332E3132002D7350002F7573722F62696E2F70756C70636F72652D776F726B6572 [2025-10-06T23:44:36.458Z] # type=SYSCALL msg=audit(1759792712.468:5864): arch=c000003e syscall=254 success=yes exit=1 a0=11 a1=7f71d7f416ae a2=1000182 a3=8 items=0 ppid=64414 pid=64956 auid=4294967295 uid=990 gid=989 euid=990 suid=990 fsuid=990 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm="pulpcore-worker" exe="/usr/bin/python3.12" subj=system_u:system_r:pulpcore_t:s0 key=(null) [2025-10-06T23:44:36.458Z] # type=AVC msg=audit(1759792712.468:5864): avc: denied { watch } for pid=64956 comm="pulpcore-worker" path="/etc" dev="vda1" ino=524290 scontext=system_u:system_r:pulpcore_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 [2025-10-06T23:44:36.458Z] # $ [ "${status}" -eq 1 ] [2025-10-06T23:44:36.458Z] [2025-10-06T23:44:36.458Z] Processing '/var/lib/jenkins/jobs/katello-nightly-rpm-pipeline/builds/2560/tap-master-files/artifacts/foreman-pipeline-katello-rpm-nightly/debug/n27-38-30.pool.ci.centos.org/tmp/debug-katello-nightly-centos9-stream-upgrade/pipe-up-katello-nightly-centos9-stream/root/bats_results_proxy_n-1_upgrade/fb-destroy-organization.bats.tap' [2025-10-06T23:44:36.458Z] Parsing TAP test result [/var/lib/jenkins/jobs/katello-nightly-rpm-pipeline/builds/2560/tap-master-files/artifacts/foreman-pipeline-katello-rpm-nightly/debug/n27-38-30.pool.ci.centos.org/tmp/debug-katello-nightly-centos9-stream-upgrade/pipe-up-katello-nightly-centos9-stream/root/bats_results_proxy_n-1_upgrade/fb-destroy-organization.bats.tap].