A cron job breaks Foreman 1.20 due to SELinux

Development
1

Hey, I just upgraded Foreman 1.20 RC1 to RC2 and then to current version but Rails won’t come up. I see this weird error:

`/usr/share/foreman` is not writable.
Bundler also failed to create a temporary home directory at `/tmp/bundler/home':
File exists @ dir_s_mkdir - /tmp/bundler (Errno::EEXIST)
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:193:in `rescue in tmp_home_path'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:181:in `tmp_home_path'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:172:in `user_home'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:197:in `user_bundle_path'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/settings.rb:377:in `global_config_file'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/settings.rb:80:in `initialize'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:257:in `new'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:257:in `settings'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler.rb:236:in `app_cache'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/source/rubygems.rb:456:in `cache_path'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/source/rubygems.rb:24:in `initialize'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/source_list.rb:16:in `new'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/source_list.rb:16:in `initialize'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/dsl.rb:26:in `new'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/dsl.rb:26:in `initialize'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/dsl.rb:11:in `new'
  /opt/rh/rh-ruby25/root/usr/share/gems/gems/bundler-1.16.1/lib/bundler/dsl.rb:11:in `evaluate'
  /opt/theforeman/tfm/root/usr/share/gems/gems/bundler_ext-0.4.1/lib/bundler_ext/gemfile.rb:46:in `parse'
  /opt/theforeman/tfm/root/usr/share/gems/gems/bundler_ext-0.4.1/lib/bundler_ext.rb:14:in `system_require'
  /usr/share/foreman/config/application.rb:17:in `<top (required)>'
  /opt/rh/rh-ruby25/root/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:59:in `require'
  /opt/rh/rh-ruby25/root/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:59:in `require'
  /usr/share/foreman/config/environment.rb:2:in `<top (required)>'
  /opt/rh/rh-ruby25/root/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:59:in `require'
  /opt/rh/rh-ruby25/root/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:59:in `require'
  config.ru:5:in `block in <main>'
  /opt/theforeman/tfm-ror52/root/usr/share/gems/gems/rack-2.0.5/lib/rack/builder.rb:55:in `instance_eval'
  /opt/theforeman/tfm-ror52/root/usr/share/gems/gems/rack-2.0.5/lib/rack/builder.rb:55:in `initialize'
  config.ru:1:in `new'
  config.ru:1:in `<main>'
  /usr/share/passenger/helper-scripts/rack-preloader.rb:112:in `eval'
  /usr/share/passenger/helper-scripts/rack-preloader.rb:112:in `preload_app'
  /usr/share/passenger/helper-scripts/rack-preloader.rb:158:in `<module:App>'
  /usr/share/passenger/helper-scripts/rack-preloader.rb:29:in `<module:PhusionPassenger>'
  /usr/share/passenger/helper-scripts/rack-preloader.rb:28:in `<main>'

Looks like it’s a SELinux denial:

allow passenger_t system_cronjob_tmp_t:dir { getattr search };

There was a directory created in /tmp that has weird SELinux label:

[root@foreman ~]# ll -Z /tmp
drwxr-xr-x. foreman foreman system_u:object_r:system_cronjob_tmp_t:s0 bundler
...

I deleted it and it works after restart, so obviously there was a cron job creating it. I need to identify which cron job does this. This is either regression in RHEL 7 (cron), passenger or in the SELinux policy. Heads up!

2

Looks like Bundler creates this directory but it should be overridable via BUNDLE_USER_HOME so I guess we can set this for cron jobs or all foreman-rake commands as well. We actually turn bundler off so it’s always empty.

Unable to reproduce.

3

Could it be from RPM scriptlets that execute some migration?

4

It is possible but the resulting file label has cron in it, so more likely to be a cron job.