<html><body><div style="font-family: Courier, Courier New, mono; font-size: 12pt; color: #000000"><div>Hello,<br></div><div><br></div><div>here the output with setenforce 1</div><div><br></div><div>type=AVC msg=audit(1455190264.543:440): avc: denied { write } for pid=4095 comm="cobblerd" name="grub.cfg" dev="dm-3" ino=5509188 scontext=system_u:system_r:cobblerd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file</div><div><br></div><div>and the output with setenforce 0</div><div><br></div><div>type=AVC msg=audit(1455190320.135:442): avc: denied { write } for pid=4158 comm="cobblerd" name="grub.cfg" dev="dm-3" ino=5509188 scontext=system_u:system_r:cobblerd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file</div><div><br></div><div>Please see the folder structure:</div><div><br></div><div><p style="margin: 0px;" data-mce-style="margin: 0px;"># ll /mnt/distros/<br>total 18<br>dr-xr-xr-x. 7 root root 4096 Aug 4 2015 CentOS6-x86_64<br>dr-xr-xr-x. 8 root root 2048 Dec 10 00:03 CentOS7-x86_64<br>drwxr-xr-x. 9 root root 4096 Nov 26 02:19 OracleLinux7-x86_64<br>drwxr-xr-x. 7 root root 4096 Aug 17 20:56 SL6-x86_64<br>drwxrwxr-x. 8 root root 4096 Apr 6 2015 SL7-x86_64</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">All other Distributions work properly.</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">I tried your solution with a test_tree-Folder but without success.</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Here is the output of journalctl:</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Feb 11 12:32:01 spacewalk.ohb-system.de setroubleshoot[4161]: Plugin Exception restorecon_source<br>Feb 11 12:32:01 spacewalk.ohb-system.de setroubleshoot[4161]: SELinux is preventing /usr/bin/python2.7 from write access on the file grub.cfg. For complete SELinux messages. run sealert -l c<br>Feb 11 12:32:01 spacewalk.ohb-system.de python[4161]: SELinux is preventing /usr/bin/python2.7 from write access on the file grub.cfg.</p><p style="margin: 0px;" data-mce-style="margin: 0px;">***** Plugin catchall (100. confidence) suggests **************************</p><p style="margin: 0px;" data-mce-style="margin: 0px;">If you believe that python2.7 should be allowed write access on the grub.cfg file by default.<br> Then you should report this as a bug.<br> You can generate a local policy module to allow this access.<br> Do<br> allow this access for now by executing:<br> # grep cobblerd /var/log/audit/audit.log | audit2allow -M mypol<br> # semodule -i mypol.pp</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">kind regards,</p><p style="margin: 0px;" data-mce-style="margin: 0px;">Philipp</p></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Jan Hutař" <jhutar@redhat.com><br><b>To: </b>spacewalk-list@redhat.com<br><b>Cc: </b>"Philipp Wehling" <philipp.wehling@megatel.de><br><b>Sent: </b>Thursday, February 11, 2016 6:25:36 AM<br><b>Subject: </b>Re: [Spacewalk-list] Create KS Distribution Error<br><div><br></div>On Tue, 2 Feb 2016 14:47:12 +0100 (CET) Philipp Wehling<br><philipp.wehling@megatel.de> wrote:<br><div><br></div>> Hello, <br>> <br>> I want to create an KS-Distribution for OracleLinux, but I get<br>> this error: <br>> <br>> Exception: <br>> javax.servlet.ServletException: java.lang.RuntimeException:<br>> redstone.xmlrpc.XmlRpcFault: <type 'exceptions.IOError'>:<br>> [Errno 13] Permission denied:<br>> '/var/lib/tftpboot/aarch64/grub.cfg' <br>> <br>> <br>> <br>> Here are the permissions of this file: <br>> <br>> <br>> <br>> # ll /var/lib/tftpboot/aarch64/grub.cfg <br>> -rw-r--r--. 1 root root 17 Jan 15<br>> 11:07 /var/lib/tftpboot/aarch64/grub.cfg <br>> <br>> # ls -Z /var/lib/tftpboot/aarch64/grub.cfg <br>> -rw-r--r--. root root<br>> system_u:object_r:public_content_t:s0 /var/lib/tftpboot/aarch64/grub.cfg <br><div><br></div>I believe Apache needs read permissions to the location from<br>where you are importing. Can you try to put it to,<br>say, /var/satellite/mine_ks_trees and make sure "apache" user<br>can read it and SELinux is set with `restorecon<br>-vR /var/satellite/mine_ks_trees`? Also<br>`tail /var/log/audit/audit.log | grep AVC` to see any AVCs.<br><div><br></div>> I think it is related to SELinux, but I dont want to turn it<br>> off. Can anyone help me? <br><div><br></div>To test if it is related, just turn it off temporarily<br>(`setenforce 0` and once you are done with testing `setenforce<br>1` and verify with `getenforce`).<br><div><br></div>> kind regards, <br>> <br>> Philipp <br><div><br></div>Thank you in advance,<br>Jan<br><div><br></div><br><div><br></div>-- <br>Jan Hutar Systems Management QA<br>jhutar@redhat.com Red Hat, Inc.<br></div><div><br></div></div></body></html>