Hello, this is what I have done to get a working config with Selinux

 

Active SELinux, edit /etc/sysconfig/selinux

SELINUX=enforcing

SELINUXTYPE=targeted

Reboot the system.

reboot

You can investigate SELinux issues without any tools by opening the audit log it generates. This log is found at /var/log/audit/audit.log. However, unless you know exactly what to look for and have a lot of free time, you’re going to find it difficult making sense of the log. For that reason we install a package that will help use to troubleshot SeLinux

yum install setroubleshoot setools

 

We now have a tool called sealert that analyzes the audit log used by SELinux. Sealert will scan the log file and report and will then generate a report containing all discovered SELinux issues.

sealert -a /var/log/audit/audit.log

 

Truncated output example

--------------------------------------------------------------------------------

 

SELinux is preventing /usr/sbin/httpd from name_connect access on the tcp_socket port 25151.

 

*****  Plugin catchall_boolean (47.5 confidence) suggests   ******************

 

If you want to allow httpd to can network connect cobbler

Then you must tell SELinux about this by enabling the 'httpd_can_network_connect_cobbler' boolean.

 

Do

setsebool -P httpd_can_network_connect_cobbler 1

 

The most important part of the report is found at the end of each alert. This is where it explains how to resolve the problem. Just run each command which you want to allow

setsebool -P httpd_can_network_connect_cobbler 1

setsebool -P httpd_can_network_connect 1

setsebool -P nis_enabled 1

setsebool -P authlogin_nsswitch_use_ldap 1

setsebool -P cobbler_can_network_connect 1

setsebool -P httpd_serve_cobbler_files 1

semanage fcontext -a -t httpd_sys_content_t “/var/mrepo(/.*)?”

restorecon -R /var/mrepo

restorecon -v /var/lib/tftpboot         

semanage fcontext -a -t public_content_t "/var/lib/tftpboot/.*"

semanage fcontext -a -t public_content_t "/var/www/cobbler/images/.*"

setsebool -P tftp_anon_write 1

setsebool -P  tftp_home_dir 1

 

 

-----Original Message-----
From: julien.tognazzi@gmail.com [mailto:julien.tognazzi@gmail.com]
Sent: mercredi 17 février 2016 10:34
To: cobbler@lists.fedorahosted.org
Subject: [cobbler] Re: trouble with cobbler get-loaders behind a proxy

 

Ok, It was a Selinux problem.

Disabling it fixed the problem.

 

Thanks anyway.

_______________________________________________

cobbler mailing list

cobbler@lists.fedorahosted.org

https://lists.fedorahosted.org/admin/lists/cobbler@lists.fedorahosted.org