Bug 1045331

Summary:	policy for openvswitch openflow controller connection is missing
Product:	[Fedora] Fedora	Reporter:	Hiroaki KAWAI <kawai>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	20	CC:	dominick.grift, dwalsh, kawai, lvrabec, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	selinux-policy-3.12.1-116.fc20	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-16 07:10:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Hiroaki KAWAI 2013-12-20 07:42:51 UTC

Description of problem:
OpenvSwitch is an openflow switch, which may be configured to connect to openflow controller over a TCP connection. selinux blocks /usr/sbin/ovs-vswitchd to establish a TCP session to the controller.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. yum install openvswitch
2. systemctl start openvswitch
3. ovs-vsctl add-br br0
4. ovs-vsctl set-controller br0 tcp:127.0.0.1:6653

Actual results:
selinux blocks tcp connection

Expected results:
allow tcp connection if some policy was provided.

Additional info:
The port number used in openflow is 6653 by IANA assignment, and 6633 is also commonly used.

Comment 1 Daniel Walsh 2014-01-02 23:01:43 UTC

Could you attach the AVC messages?

Comment 2 Hiroaki KAWAI 2014-01-10 02:14:06 UTC

SELinux is preventing /usr/sbin/ovs-vswitchd from name_connect access on the tcp_socket .

*****  Plugin connect_ports (99.5 confidence) suggests   *********************

If you want to allow /usr/sbin/ovs-vswitchd to connect to network port 6653
Then you need to modify the port type.
Do
# semanage port -a -t dns_port_t -p tcp 6653

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that ovs-vswitchd should be allowed name_connect access on the  tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ovs-vswitchd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:openvswitch_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                 [ tcp_socket ]
Source                        ovs-vswitchd
Source Path                   /usr/sbin/ovs-vswitchd
Port                          6653
Host                          localhost.localdomain
Source RPM Packages           openvswitch-2.0.0-1.fc20.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.12.1-106.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 3.12.6-300.fc20.x86_64
                              #1 SMP Mon Dec 23 16:44:31 UTC 2013 x86_64 x86_64
Alert Count                   1511
First Seen                    2013-12-20 16:31:26 JST
Last Seen                     2014-01-10 11:12:33 JST
Local ID                      2cfe66ca-f72a-4dc0-ba1d-5402e90884f9

Raw Audit Messages
type=AVC msg=audit(1389319953.771:533): avc:  denied  { name_connect } for  pid=2674 comm="ovs-vswitchd" dest=6653 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1389319953.771:533): arch=x86_64 syscall=connect success=no exit=EINPROGRESS a0=1f a1=7fff0de16350 a2=10 a3=0 items=0 ppid=2673 pid=2674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null)

Hash: ovs-vswitchd,openvswitch_t,unreserved_port_t,tcp_socket,name_connect

Comment 3 Miroslav Grepl 2014-01-10 08:25:57 UTC

commit bf8f6e01f11d31c83f61bfaf1ce43dd39498542b
Author: Miroslav Grepl <mgrepl>
Date:   Fri Jan 10 09:25:40 2014 +0100

    Allow OpenvSwitch to connec to openflow ports

Comment 4 Fedora Update System 2014-01-13 22:56:12 UTC

selinux-policy-3.12.1-116.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-116.fc20

Comment 5 Fedora Update System 2014-01-15 05:57:52 UTC

Package selinux-policy-3.12.1-116.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-116.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-0806/selinux-policy-3.12.1-116.fc20
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2014-01-16 07:10:31 UTC

selinux-policy-3.12.1-116.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.