I have a fix for it at http://github.com/ciupicri/cobbler/commit/507b38453f7cafe42f2e37b406b0856c7d... In case there's a git problem my repo is git://github.com/ciupicri/cobbler.git (the release20 branch, although main has it too) and the patch is also available in the bug tracker.
I've tested the patch and it works fine, except for a tiny problem. /etc/httpd/conf.d/cobbler.conf contains this line:
AliasMatch ^/cobbler(.*)?$ "/var/www/cobbler$1"
which means that the cobbler_webui_sessions directory will be shared just like cobbler_webui_content. I propose to replace the regular expression with an explicit list of directories. As "The Zen of Python" says it, "Explicit is better than implicit". Another option could be to rename cobbler_ui_sessions to something else, e.g. sessions_cobbler. I'm waiting for your suggestions on this, so I can send another patch.
If you're for the first solution, are there any other directories starting with cobbler besides these? - cobbler - cobbler_webui_content - cobbler_api - cobbler_web - cobbler_track.... (which is covered by another AliasMatch line)
Thank you, Cristian
On 10/01/2009 05:08 PM, Cristian Ciupitu wrote:
I have a fix for it at http://github.com/ciupicri/cobbler/commit/507b38453f7cafe42f2e37b406b0856c7d... In case there's a git problem my repo is git://github.com/ciupicri/cobbler.git (the release20 branch, although main has it too) and the patch is also available in the bug tracker.
I've tested the patch and it works fine, except for a tiny problem. /etc/httpd/conf.d/cobbler.conf contains this line:
AliasMatch ^/cobbler(.*)?$ "/var/www/cobbler$1"
which means that the cobbler_webui_sessions directory will be shared just like cobbler_webui_content. I propose to replace the regular expression with an explicit list of directories. As "The Zen of Python" says it, "Explicit is better than implicit". Another option could be to rename cobbler_ui_sessions to something else, e.g. sessions_cobbler. I'm waiting for your suggestions on this, so I can send another patch.
If you're for the first solution, are there any other directories starting with cobbler besides these?
- cobbler
- cobbler_webui_content
- cobbler_api
- cobbler_web
- cobbler_track.... (which is covered by another AliasMatch line)
Thank you, Cristian
cobbler-devel mailing list cobbler-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/cobbler-devel
/var/www is really intended for user content, not even so much app content (which we need to be moving more of cobbler's support content to /usr/share over time -- data that we mirror lives nicely in /var/www and there is resistance to moving it, even with a symlink). Sharing sessions is obviously something we don't want to do, and we don't want someone to have to worry about that when configuring Apache on a shared server.
Sessions do belong in /var of course, but not /var/www.
A good location to me seems to be /var/lib/cobbler/web_sessions. We already own /var/lib/cobbler, and can put what we want there.
--Michael
----- Original Message ----
From: Michael DeHaan mdehaan@redhat.com Sent: Friday, October 2, 2009 12:34:49 AM A good location to me seems to be /var/lib/cobbler/web_sessions. We already own /var/lib/cobbler, and can put what we want there.
You're right. I was too narrow minded when I chose that directory. Your idea sounds great/sane to me and I'll implement it right away.
Thank you, Cristian
On 10/01/2009 05:41 PM, Cristian Ciupitu wrote:
----- Original Message ----
From: Michael DeHaanmdehaan@redhat.com Sent: Friday, October 2, 2009 12:34:49 AM A good location to me seems to be /var/lib/cobbler/web_sessions. We already own /var/lib/cobbler, and can put what we want there.
You're right. I was too narrow minded when I chose that directory. Your idea sounds great/sane to me and I'll implement it right away.
Thank you, Cristian
cobbler-devel mailing list cobbler-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/cobbler-devel
Excellent, when you update that, be sure to also update the paths checked in action_check.py for SELinux context. I recently added the current sessions directory.
--Michael
From: Michael DeHaan mdehaan@redhat.com To: cobbler development list cobbler-devel@lists.fedorahosted.org Sent: Friday, October 2, 2009 12:48:31 AM Subject: Re: [PATCH] sessions directory should be moved from /usr/share/cobbler/web to /var (#499)
On 10/01/2009 05:41 PM, Cristian Ciupitu wrote:
----- Original Message ----
From: Michael DeHaan mdehaan@redhat.com
Sent: Friday, October 2, 2009 12:34:49 AM A good location to me seems to be /var/lib/cobbler/web_sessions. We already own /var/lib/cobbler, and can put what we want there.
You're right. I was too narrow minded when I chose that directory. Your idea sounds great/sane to me and I'll implement it right away.
Thank you, Cristian
Excellent, when you update that, be sure to also update the paths checked in action_check.py for SELinux context. I recently added the current sessions directory.
--Michael
Speaking of SELinux, I've noticed that /var/lib/cobbler/webui_sessions directory has a var_lib_t context which implies (based on "sesearch --allow -s httpd_t"):
allow httpd_t var_lib_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
The files under it have a httpd_var_lib_t context which implies:
allow httpd_t httpd_var_lib_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
I'm using targeted SELinux and I haven't noticed any problems. Btw, we should mention this move to Miroslav Grepl which is writing a policy for cobbler; see https://bugzilla.redhat.com/show_bug.cgi?id=525965 for more details.
Regarding the ultra-new action_check.py, I see that you're checking for httpd_sys_content_t, but as I've mentioned earlier the sessions directory uses by default another context, so for what context should I check: httpd_sys_content_t or var_lib_t?
The current patch is at git://github.com/ciupicri/cobbler.git (release20 branch) http://github.com/ciupicri/cobbler/commit/f87d0bed9507754bf795999aff48bccacb... (I've done some ugly rebases)
Cheers, Cristian
On 10/01/2009 07:02 PM, Cristian Ciupitu wrote:
From: Michael DeHaanmdehaan@redhat.com To: cobbler development listcobbler-devel@lists.fedorahosted.org Sent: Friday, October 2, 2009 12:48:31 AM Subject: Re: [PATCH] sessions directory should be moved from /usr/share/cobbler/web to /var (#499)
On 10/01/2009 05:41 PM, Cristian Ciupitu wrote:
----- Original Message ----
From: Michael DeHaanmdehaan@redhat.com
Sent: Friday, October 2, 2009 12:34:49 AM A good location to me seems to be /var/lib/cobbler/web_sessions. We already own /var/lib/cobbler, and can put what we want there.
You're right. I was too narrow minded when I chose that directory. Your idea sounds great/sane to me and I'll implement it right away.
Thank you, Cristian
Excellent, when you update that, be sure to also update the paths checked in action_check.py for SELinux context. I recently added the current sessions directory.
--Michael
Speaking of SELinux, I've noticed that /var/lib/cobbler/webui_sessions directory has a var_lib_t context which implies (based on "sesearch --allow -s httpd_t"):
allow httpd_t var_lib_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
The files under it have a httpd_var_lib_t context which implies:
allow httpd_t httpd_var_lib_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
I'm using targeted SELinux and I haven't noticed any problems. Btw, we should mention this move to Miroslav Grepl which is writing a policy for cobbler; see https://bugzilla.redhat.com/show_bug.cgi?id=525965 for more details.
Odd that he wouldn't talk about it here.
Miroslav, if you're out there, let's talk.
Regarding the ultra-new action_check.py, I see that you're checking for httpd_sys_content_t, but as I've mentioned earlier the sessions directory uses by default another context, so for what context should I check: httpd_sys_content_t or var_lib_t?
Part of the job for today was to test it to see what it actually needed.
var_lib_t is probably correct, but we have to test it live to make sure.
Once things work, things work.
The current patch is at git://github.com/ciupicri/cobbler.git (release20 branch) http://github.com/ciupicri/cobbler/commit/f87d0bed9507754bf795999aff48bccacb... (I've done some ugly rebases)
This is going to be held for 2.1, so I'll put it in my queue folder. We can discuss more then.
Cheers, Cristian
cobbler-devel mailing list cobbler-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/cobbler-devel
----- Original Message ----
From: Cristian Ciupitu cristian.ciupitu@yahoo.com To: cobbler development list cobbler-devel@lists.fedorahosted.org Sent: Friday, October 2, 2009 2:02:59 AM Subject: Re: [PATCH] sessions directory should be moved from /usr/share/cobbler/web to /var (#499)
Regarding the ultra-new action_check.py, I see that you're checking for httpd_sys_content_t, but as I've mentioned earlier the sessions directory uses by default another context, so for what context should I check: httpd_sys_content_t or var_lib_t?
One more thing regarding the SELinux context. Besides httpd_sys_content_t there is also httpd_sys_content_rw_t. The man page says:
The following file contexts types are defined for httpd: - Set files with httpd_sys_content_t if you want httpd_sys_script_exec_t scripts and the daemon to read the file, and disallow other non sys scripts from access. - Set files with httpd_sys_content_rw_t if you want httpd_sys_script_exec_t scripts and the daemon to *read/write* the data, and disallow other non sys scripts from access.
Anyway, I've modified the directories from "action_check.py". See git://github.com/ciupicri/cobbler.git branch bugfix499. I'm still a git newbie so sorry for all these git related changes.
Thank you, Cristian
On 10/02/2009 10:44 AM, Cristian Ciupitu wrote:
----- Original Message ----
From: Cristian Ciupitucristian.ciupitu@yahoo.com To: cobbler development listcobbler-devel@lists.fedorahosted.org Sent: Friday, October 2, 2009 2:02:59 AM Subject: Re: [PATCH] sessions directory should be moved from /usr/share/cobbler/web to /var (#499)
Regarding the ultra-new action_check.py, I see that you're checking for httpd_sys_content_t, but as I've mentioned earlier the sessions directory uses by default another context, so for what context should I check: httpd_sys_content_t or var_lib_t?
One more thing regarding the SELinux context. Besides httpd_sys_content_t there is also httpd_sys_content_rw_t. The man page says:
The following file contexts types are defined for httpd:
- Set files with httpd_sys_content_t if you want httpd_sys_script_exec_t scripts and the daemon to read the file, and disallow other non sys scripts from access.
- Set files with httpd_sys_content_rw_t if you want httpd_sys_script_exec_t scripts and the daemon to *read/write* the data, and disallow other non sys scripts from access.
Anyway, I've modified the directories from "action_check.py". See git://github.com/ciupicri/cobbler.git branch bugfix499. I'm still a git newbie so sorry for all these git related changes.
Thank you, Cristian
Taking a look ... I need to do various SELinux related testing so I'll post up with what the situation is later today as to whether we'll go with this or also need additional changes.
As for git, keeping different fixes on different branches rather than requiring cherry-picking is a very good way to do it. It is better than assuming all patches will get applied in sequence.
--Michael
On 10/02/2009 10:44 AM, Cristian Ciupitu wrote:
----- Original Message ----
From: Cristian Ciupitucristian.ciupitu@yahoo.com To: cobbler development listcobbler-devel@lists.fedorahosted.org Sent: Friday, October 2, 2009 2:02:59 AM Subject: Re: [PATCH] sessions directory should be moved from /usr/share/cobbler/web to /var (#499)
Regarding the ultra-new action_check.py, I see that you're checking for httpd_sys_content_t, but as I've mentioned earlier the sessions directory uses by default another context, so for what context should I check: httpd_sys_content_t or var_lib_t?
One more thing regarding the SELinux context. Besides httpd_sys_content_t there is also httpd_sys_content_rw_t. The man page says:
The following file contexts types are defined for httpd:
- Set files with httpd_sys_content_t if you want httpd_sys_script_exec_t scripts and the daemon to read the file, and disallow other non sys scripts from access.
- Set files with httpd_sys_content_rw_t if you want httpd_sys_script_exec_t scripts and the daemon to *read/write* the data, and disallow other non sys scripts from access.
Anyway, I've modified the directories from "action_check.py". See git://github.com/ciupicri/cobbler.git branch bugfix499. I'm still a git newbie so sorry for all these git related changes.
Thank you, Cristian
cobbler-devel mailing list cobbler-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/cobbler-devel
This branch is still on hold since it moves the path of the sessions directory.
I'll work on just setting the right SELinux context for today.
We want to keep the changes to 2.0.1 minimal.
--Michael
The fix for bug #499 (https://fedorahosted.org/cobbler/ticket/499) is available at git://github.com/ciupicri/cobbler.git on the master-bugfix499 branch.
cobbler-devel@lists.fedorahosted.org