Merge pull request #19631 from carbonin/reduce_number_of_cockpit_seli…

…nux_changes Reduce number of cockpit selinux changes
ManageIQ · Dec 11, 2019 · 771f620 · 771f620
2 parents dffc990 + cbeb464
commit 771f620
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 281 deletions.
diff --git a/app/models/miq_cockpit_ws_worker/runner.rb b/app/models/miq_cockpit_ws_worker/runner.rb
@@ -148,7 +148,9 @@ def cockpit_ws_run
       "XDG_CONFIG_DIRS" => cockpit_ws.config_dir,
       "DRB_URI"         => @drb_uri
     }
-    stdin, stdout, stderr, wait_thr = Open3.popen3(env, *cockpit_ws.command(BINDING_ADDRESS))
+    Bundler.with_clean_env do
+      stdin, stdout, stderr, wait_thr = Open3.popen3(env, *cockpit_ws.command(BINDING_ADDRESS), :unsetenv_others => true)
+    end
     stdin.close
 
     _log.info("#{log_prefix} cockpit-ws process started - pid=#{@pid}")

diff --git a/lib/miq_cockpit.rb b/lib/miq_cockpit.rb
@@ -90,6 +90,7 @@ def save_config
       fname = File.join(@cockpit_conf_dir, "cockpit.conf")
       update_config
       File.write(fname, @config)
+      AwesomeSpawn.run!("restorecon -R -v #{@cockpit_conf_dir}")
     end
 
     def web_ui_url
@@ -115,7 +116,7 @@ def web_ui_url
     def update_config
       title = @opts[:title] || "ManageIQ Cockpit"
 
-      login_command = Rails.root.join("tools", "cockpit", "cockpit-auth-miq")
+      login_command = File.join("/usr", "bin", "cockpit-auth-miq")
 
       @config = <<-END_OF_CONFIG
 [Webservice]

diff --git a/spec/lib/miq_cockpit_spec.rb b/spec/lib/miq_cockpit_spec.rb
@@ -4,6 +4,8 @@
     @miq_server = EvmSpecHelper.local_miq_server
     @miq_server.ipaddress = "10.0.0.1"
     @miq_server.has_active_userinterface = true
+
+    allow(AwesomeSpawn).to receive(:run!)
   end
 
   describe '#url' do
@@ -104,15 +106,11 @@
   end
 
   describe 'update_config' do
-    before do
-      @login_command = Rails.root.join("tools", "cockpit", "cockpit-auth-miq")
-    end
-
     context "when using empty opts" do
       it "it uses defaults" do
         ins = MiqCockpit::WS.new(nil)
         config = ins.update_config
-        expect(config).to include("\n[SSH-Login]\ncommand = #{@login_command}\n")
+        expect(config).to include("\n[SSH-Login]\ncommand = /usr/bin/cockpit-auth-miq\n")
         expect(config).to include("\n[Basic]\nAction = none\n")
         expect(config).to include("\n[Negotiate]\nAction = none\n")
         expect(config).to include("\nLoginTitle = ManageIQ Cockpit\n")

diff --git a/tools/cockpit/cockpit-auth-miq b/tools/cockpit/cockpit-auth-miq