pulp/pulpcore-selinux

SELinux prevented pulpcore-worker to come online

Closed this issue · 0 comments

The pulpcore-worker was offline because of pulpcore-worker init process doesnot have access to the postgresql port is what was found out while debugged.
This occured when the centos kernel was upgraded.
And also on fresh installation of pulp on SLES 15-SP3.

When selinux mode was set to permissive the pulpcore-worker was coming online and getting terminated frequently and the same process repeated when the system logs were monitored.

sudo ausearch -m AVC,USER_AVC -ts recent

time->Fri May 13 02:01:43 2022
type=AVC msg=audit(1652407303.704:46040): avc: denied { name_connect } for pid=64260 comm="gunicorn" dest=5432 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket permissive=1

sudo cat /var/log/audit/audit.log | grep postgresql

type=AVC msg=audit(1652318803.290:32724): avc: denied { name_connect } for pid=28995 comm="gunicorn" dest=5432 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket permissive=1
type=AVC msg=audit(1652318803.890:32738): avc: denied { name_connect } for pid=29027 comm="gunicorn" dest=5432 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket permissive=1
type=AVC msg=audit(1652318805.074:32741): avc: denied { name_connect } for pid=29026 comm="gunicorn" dest=5432 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket permissive=1