[
https://issues.apache.org/jira/browse/AIRAVATA-2691?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Marcus Christie reassigned AIRAVATA-2691:
-----------------------------------------
Assignee: Marcus Christie
> Django: large file uploads fail: unable to "relabelfrom"
> --------------------------------------------------------
>
> Key: AIRAVATA-2691
> URL: https://issues.apache.org/jira/browse/AIRAVATA-2691
> Project: Airavata
> Issue Type: Bug
> Reporter: Marcus Christie
> Assignee: Marcus Christie
> Priority: Major
>
> In Django, by default, files that are larger than 2.5 MB are written to /tmp
> when they are uploaded. Smaller files are simply held in memory. When the
> Django portal then tries to move an uploaded file from /tmp to the
> gateway-user-data directory it triggers an SELinux error:
> Here's the output of running {{sealert -a /var/log/audit/audit.log}}:
> {noformat}
> SELinux is preventing /usr/sbin/httpd from relabelfrom access on the file
> geombc.dat.1.
> ***** Plugin catchall (100. confidence) suggests **************************
> If you believe that httpd should be allowed relabelfrom access on the
> geombc.dat.1 file by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
> # semodule -i my-httpd.pp
> Additional Information:
> Source Context system_u:system_r:httpd_t:s0
> Target Context system_u:object_r:httpd_sys_rw_content_t:s0
> Target Objects geombc.dat.1 [ file ]
> Source httpd
> Source Path /usr/sbin/httpd
> Port <Unknown>
> Host <Unknown>
> Source RPM Packages httpd-2.4.6-67.el7.centos.6.x86_64
> Target RPM Packages
> Policy RPM selinux-policy-3.13.1-166.el7_4.4.noarch
> Selinux Enabled True
> Policy Type targeted
> Enforcing Mode Enforcing
> Host Name pga-scigap-develop.novalocal
> Platform Linux pga-scigap-develop.novalocal
> 3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25
> 17:04:51 UTC 2017 x86_64 x86_64
> Alert Count 5
> First Seen 2018-02-22 19:15:23 UTC
> Last Seen 2018-02-22 21:52:20 UTC
> Local ID 210abd1e-8284-43c0-b94c-4741bcc1a037
> Raw Audit Messages
> type=AVC msg=audit(1519336340.609:177951): avc: denied { relabelfrom } for
> pid=16307 comm="httpd" name="geombc.dat.1" dev="sdb" ino=231489026
> scontext=system_u:system_r:httpd_t:s0
> tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
> type=SYSCALL msg=audit(1519336340.609:177951): arch=x86_64 syscall=setxattr
> success=no exit=EACCES a0=7fda97ec63c0 a1=7fda9c116f30 a2=7fda9c193d88 a3=21
> items=0 ppid=24650 pid=16307 auid=4294967295 uid=48 gid=48 euid=48 suid=48
> fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd
> exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
> Hash: httpd,httpd_t,httpd_sys_rw_content_t,file,relabelfrom
> {noformat}
> For now I've been able to work around this by setting FILE_UPLOAD_TEMP_DIR in
> settings_local.py to a location inside of gateway-user-data.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
