Bug 1087698

Summary: iscsi denials preventing baremetal instances to boot on virt-builder built images
Product: [Fedora] Fedora Reporter: Richard Su <rwsu>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: ccrouch, dominick.grift, dwalsh, lvrabec, mgrepl, ptoscano, rjones
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.12.1-158.fc20 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-01 22:29:09 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
audit.log from undercloud instance
none
custom policy to allow baremetal instances to boot none

Description Richard Su 2014-04-15 06:01:47 UTC 
Description of problem:
When the instack undercloud cloud is built using virt-builder, baremetal instances do not boot up properly because of iscsi avc denials

When the instack undercloud cloud is built using a Fedora 20 live cd, iscsi avc denials do not occur.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-153.fc20.noarch
selinux-policy-3.12.1-153.fc20.noarch

How reproducible:
always

Steps to Reproduce:
Build and deploy instack undercloud using this guide https://github.com/agroup/instack-undercloud/blob/master/README-virt.md
Choose package install.

Actual results:
baremetal instances do not boot up. avc denials attached.

Expected results:
baremetal instances should boot with no avc denials.

Additional info:
Attached audit.log and custom policies to work around the issue.
Comment 1 Richard Su 2014-04-15 06:31:43 UTC 
Created attachment 886356 [details]
audit.log from undercloud instance
Comment 2 Richard Su 2014-04-15 06:33:52 UTC 
Created attachment 886357 [details]
custom policy to allow baremetal instances to boot
Comment 3 Miroslav Grepl 2014-04-15 07:03:16 UTC 
commit 614675e48460790b2c20a6566062ab1926678a9a
Author: Miroslav Grepl <mgrepl>
Date:   Tue Apr 15 09:03:01 2014 +0200

    Allow iscsid to handle own unit files

commit ab64b4c70bbac155d47323d6a4469be3590468b1
Author: Miroslav Grepl <mgrepl>
Date:   Tue Apr 15 09:01:41 2014 +0200

    Add iscsi_systemctl()
Comment 4 Fedora Update System 2014-04-25 12:43:34 UTC 
selinux-policy-3.12.1-158.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-158.fc20
Comment 5 Fedora Update System 2014-04-26 09:24:13 UTC 
Package selinux-policy-3.12.1-158.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-158.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-5660/selinux-policy-3.12.1-158.fc20
then log in and leave karma (feedback).
Comment 6 Fedora Update System 2014-05-01 22:29:09 UTC 
selinux-policy-3.12.1-158.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.