{"action":"created","issue":{"url":"https://api.github.com/repos/pulp/pulp/issues/1765","labels_url":"https://api.github.com/repos/pulp/pulp/issues/1765/labels{/name}","comments_url":"https://api.github.com/repos/pulp/pulp/issues/1765/comments","events_url":"https://api.github.com/repos/pulp/pulp/issues/1765/events","html_url":"https://github.com/pulp/pulp/pull/1765","id":66212666,"number":1765,"title":"Removes dontaudit rules from pulp-server SELinux policy","user":{"login":"bmbouter","id":180319,"avatar_url":"https://avatars.githubusercontent.com/u/180319?v=3","gravatar_id":"","url":"https://api.github.com/users/bmbouter","html_url":"https://github.com/bmbouter","followers_url":"https://api.github.com/users/bmbouter/followers","following_url":"https://api.github.com/users/bmbouter/following{/other_user}","gists_url":"https://api.github.com/users/bmbouter/gists{/gist_id}","starred_url":"https://api.github.com/users/bmbouter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmbouter/subscriptions","organizations_url":"https://api.github.com/users/bmbouter/orgs","repos_url":"https://api.github.com/users/bmbouter/repos","events_url":"https://api.github.com/users/bmbouter/events{/privacy}","received_events_url":"https://api.github.com/users/bmbouter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"beav","id":563254,"avatar_url":"https://avatars.githubusercontent.com/u/563254?v=3","gravatar_id":"","url":"https://api.github.com/users/beav","html_url":"https://github.com/beav","followers_url":"https://api.github.com/users/beav/followers","following_url":"https://api.github.com/users/beav/following{/other_user}","gists_url":"https://api.github.com/users/beav/gists{/gist_id}","starred_url":"https://api.github.com/users/beav/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/beav/subscriptions","organizations_url":"https://api.github.com/users/beav/orgs","repos_url":"https://api.github.com/users/beav/repos","events_url":"https://api.github.com/users/beav/events{/privacy}","received_events_url":"https://api.github.com/users/beav/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-04-03T19:24:09Z","updated_at":"2015-04-06T13:56:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pulp/pulp/pulls/1765","html_url":"https://github.com/pulp/pulp/pull/1765","diff_url":"https://github.com/pulp/pulp/pull/1765.diff","patch_url":"https://github.com/pulp/pulp/pull/1765.patch"},"body":"closes #564"},"comment":{"url":"https://api.github.com/repos/pulp/pulp/issues/comments/90071931","html_url":"https://github.com/pulp/pulp/pull/1765#issuecomment-90071931","issue_url":"https://api.github.com/repos/pulp/pulp/issues/1765","id":90071931,"user":{"login":"bmbouter","id":180319,"avatar_url":"https://avatars.githubusercontent.com/u/180319?v=3","gravatar_id":"","url":"https://api.github.com/users/bmbouter","html_url":"https://github.com/bmbouter","followers_url":"https://api.github.com/users/bmbouter/followers","following_url":"https://api.github.com/users/bmbouter/following{/other_user}","gists_url":"https://api.github.com/users/bmbouter/gists{/gist_id}","starred_url":"https://api.github.com/users/bmbouter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmbouter/subscriptions","organizations_url":"https://api.github.com/users/bmbouter/orgs","repos_url":"https://api.github.com/users/bmbouter/repos","events_url":"https://api.github.com/users/bmbouter/events{/privacy}","received_events_url":"https://api.github.com/users/bmbouter/received_events","type":"User","site_admin":false},"created_at":"2015-04-06T13:56:45Z","updated_at":"2015-04-06T13:56:45Z","body":"@beav Yes the restructuring is what allows us to remove it.\r\n\r\nThe `dontaudit` rule was probably unwise to add from the start. Separate from that, the SELinux restructuring we've done lets us remove it now. At that time, all Pulp operations ran inside of `httpd` which was constrained b the `pulp-server` SELinux policy which had the `dontaudit` rule added to it. Now sync runs inside of `pulp_workers` which is governed  by the `pulp-celery` SELinux policy. The right permissions have been granted there which allows the necessary operations. This is why removing the `dontaudit` doesn't cause the AVC denials we were seeing before."}}