Repository: cobbler/cobbler

Issue:
cobbler import rsync fails from mounted ISO media with SELinux enabled with return code 23
### Describe the bug

When you mount an ISO image - the permissions of the mounted files are read only:
```
# ls -la /mnt
total 38
dr-xr-xr-x.  1 root root  2048 Oct 29 22:06 ./
dr-xr-xr-x. 25 root root  4096 Oct 26 08:44 ../
dr-xr-xr-x.  1 root root  2048 Oct 29 22:06 AppStream/
dr-xr-xr-x.  1 root root  2048 Oct 29 22:06 BaseOS/
-r--r--r--.  1 root root    45 Oct 29 22:06 .discinfo
dr-xr-xr-x.  1 root root  2048 Oct 29 21:53 EFI/
-r--r--r--.  1 root root   299 Oct 29 22:06 EULA
-r--r--r--.  1 root root   745 Oct 29 22:06 extra_files.json
dr-xr-xr-x.  1 root root  2048 Oct 29 21:53 images/
dr-xr-xr-x.  1 root root  2048 Oct 29 21:53 isolinux/
-r--r--r--.  1 root root 18092 Oct 29 22:06 LICENSE
-r--r--r--.  1 root root    88 Oct 29 22:06 media.repo
-r--r--r--.  1 root root  1530 Oct 29 22:06 .treeinfo
```
When you run `cobbler import --path=/mnt` the rsync will fail:
```
running: ['rsync', '--archive', '--progress', '/mnt/', '/var/www/cobbler/distro_mirror/centos-stream-9']
received on stdout: sending incremental file list
Exception occurred: <class 'RuntimeError'>
Exception value: rsync import failed with return code 23!
Exception Info:
!!! TASK FAILED !!!
```

### Steps to reproduce

1. mount -o loop /path/to/ISO /mnt
2. cobbler import --path=/mnt

### Expected behavior

Distro is imported.

### Cobbler version

<!--- Paste output from `cobbler version` -->
````paste below
Cobbler 3.4.0
  source: ?, ?
  build time: Sat Nov  4 21:15:48 2023
````

### Operating system

CentOS Stream 8

### Cobbler log

<!--- Paste (partial) output from `/var/log/cobbler/cobbler.log` -->
````paste below
2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | importing from a network location, running rsync to fetch the files first
[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | running: ['rsync', '--archive', '--progress', '/tmp/Fedora-Server-x86_64-38-1.6.iso/', '/var/www/cobbler/distro_mirror/fedora-38']
[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | received on stdout: sending incremental file list

[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | Exception occurred: <class 'RuntimeError'>
[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | Exception value: rsync import failed with return code 23!
[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - INFO | Exception Info:
  File "/usr/lib/python3.6/site-packages/cobbler/utils/thread.py", line 103, in run
    return_code = self._run(self)

  File "/usr/lib/python3.6/site-packages/cobbler/remote.py", line 398, in runner
    self.options.get("os_version", None),

  File "/usr/lib/python3.6/site-packages/cobbler/api.py", line 2327, in import_tree
    os_version,

  File "/usr/lib/python3.6/site-packages/cobbler/actions/importer.py", line 127, in run
    f"rsync import failed with return code {rsync_return_code}!"

[2023-11-04_160526_Media import_8a52b82c5b54433587b15bc9e9d2e21f] 2023-11-04T16:05:26 - ERROR | ### TASK FAILED ###
````

### Additional information

The problem is that the read-only permissions are copied to the destination, and then cobbler does not have permission to write to the destination without the `dac_override` permission which is not granted:
```
type=AVC msg=audit(1699229796.164:5238): avc:  denied  { dac_override } for  pid=142026 comm="rsync" capability=1  scontext=system_u:system_r:cobblerd_t:s0 tcontext=system_u:system_r:cobblerd_t:s0 tclass=capability permissive=0
```

I will be submitting a pull request the changes the rsync options to grant write permissions on the destination, which is what we would want anyway.


Discussion:

Resolving patch:
diff --git a/cobbler/actions/importer.py b/cobbler/actions/importer.py
--- a/cobbler/actions/importer.py
+++ b/cobbler/actions/importer.py
@@ -106,7 +106,8 @@ def run(
         spacer = ""
         if not mirror_url.startswith("rsync://") and not mirror_url.startswith("/"):
             spacer = ' -e "ssh" '
-        rsync_cmd = ["rsync", "--archive"]
+        # --archive but without -p to avoid copying read-only ISO permissions and making sure we have write access
+        rsync_cmd = ["rsync", "-rltgoD", "--chmod=ug=rwX"]
         if spacer != "":
             rsync_cmd.append(spacer)
         rsync_cmd.append("--progress")


Test patch: