Marcus Christie created AIRAVATA-2691:
-----------------------------------------
Summary: Django: large file uploads fail: unable to "relabelfrom"
Key: AIRAVATA-2691
URL: https://issues.apache.org/jira/browse/AIRAVATA-2691
Project: Airavata
Issue Type: Bug
Reporter: Marcus Christie
In Django, by default, files that are larger than 2.5 MB are written to /tmp
when they are uploaded. Smaller files are simply held in memory. When the
Django portal then tries to move an uploaded file from /tmp to the
gateway-user-data directory it triggers an SELinux error:
Here's the output of running {{sealert -a /var/log/audit/audit.log}}:
{noformat}
SELinux is preventing /usr/sbin/httpd from relabelfrom access on the file
geombc.dat.1.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that httpd should be allowed relabelfrom access on the
geombc.dat.1 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -i my-httpd.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:object_r:httpd_sys_rw_content_t:s0
Target Objects geombc.dat.1 [ file ]
Source httpd
Source Path /usr/sbin/httpd
Port <Unknown>
Host <Unknown>
Source RPM Packages httpd-2.4.6-67.el7.centos.6.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.13.1-166.el7_4.4.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name pga-scigap-develop.novalocal
Platform Linux pga-scigap-develop.novalocal
3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25
17:04:51 UTC 2017 x86_64 x86_64
Alert Count 5
First Seen 2018-02-22 19:15:23 UTC
Last Seen 2018-02-22 21:52:20 UTC
Local ID 210abd1e-8284-43c0-b94c-4741bcc1a037
Raw Audit Messages
type=AVC msg=audit(1519336340.609:177951): avc: denied { relabelfrom } for
pid=16307 comm="httpd" name="geombc.dat.1" dev="sdb" ino=231489026
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
type=SYSCALL msg=audit(1519336340.609:177951): arch=x86_64 syscall=setxattr
success=no exit=EACCES a0=7fda97ec63c0 a1=7fda9c116f30 a2=7fda9c193d88 a3=21
items=0 ppid=24650 pid=16307 auid=4294967295 uid=48 gid=48 euid=48 suid=48
fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd
exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: httpd,httpd_t,httpd_sys_rw_content_t,file,relabelfrom
{noformat}
For now I've been able to work around this by setting FILE_UPLOAD_TEMP_DIR in
settings_local.py to a location inside of gateway-user-data.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
