Marcus Christie created AIRAVATA-2691:

             Summary: Django: large file uploads fail: unable to "relabelfrom"
                 Key: AIRAVATA-2691
             Project: Airavata
          Issue Type: Bug
            Reporter: Marcus Christie

In Django, by default, files that are larger than 2.5 MB are written to /tmp 
when they are uploaded. Smaller files are simply held in memory.  When the 
Django portal then tries to move an uploaded file from /tmp to the 
gateway-user-data directory it triggers an SELinux error:

Here's the output of running {{sealert -a /var/log/audit/audit.log}}:

SELinux is preventing /usr/sbin/httpd from relabelfrom access on the file 

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that httpd should be allowed relabelfrom access on the 
geombc.dat.1 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -i my-httpd.pp

Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:httpd_sys_rw_content_t:s0
Target Objects                geombc.dat.1 [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           httpd-2.4.6-67.el7.centos.6.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-166.el7_4.4.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     pga-scigap-develop.novalocal
Platform                      Linux pga-scigap-develop.novalocal
                              3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25
                              17:04:51 UTC 2017 x86_64 x86_64
Alert Count                   5
First Seen                    2018-02-22 19:15:23 UTC
Last Seen                     2018-02-22 21:52:20 UTC
Local ID                      210abd1e-8284-43c0-b94c-4741bcc1a037

Raw Audit Messages
type=AVC msg=audit(1519336340.609:177951): avc:  denied  { relabelfrom } for  
pid=16307 comm="httpd" name="geombc.dat.1" dev="sdb" ino=231489026 
tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file

type=SYSCALL msg=audit(1519336340.609:177951): arch=x86_64 syscall=setxattr 
success=no exit=EACCES a0=7fda97ec63c0 a1=7fda9c116f30 a2=7fda9c193d88 a3=21 
items=0 ppid=24650 pid=16307 auid=4294967295 uid=48 gid=48 euid=48 suid=48 
fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd 
exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: httpd,httpd_t,httpd_sys_rw_content_t,file,relabelfrom

For now I've been able to work around this by setting FILE_UPLOAD_TEMP_DIR in to a location inside of gateway-user-data.

This message was sent by Atlassian JIRA

Reply via email to