Bug 1107861
| Summary: | Selinux blocks Nova services on RHEL7, can't boot or delete instances, | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | James Slagle <jslagle> |
| Component: | openstack-selinux | Assignee: | Lon Hohberger <lhh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Ami Jeain <ajeain> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 5.0 (RHEL 7) | CC: | beagles, gfidente, lhh, mgrepl, mmalik, tshefi, yeylon, yrabl |
| Target Milestone: | rc | ||
| Target Release: | 5.0 (RHEL 7) | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1083566 | Environment: | |
| Last Closed: | 2014-06-13 09:51:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1083566 | ||
| Bug Blocks: | |||
|
Description
James Slagle
2014-06-10 20:05:01 UTC
Was able to reproduce this under packstack with rhel osp 5. created vm from rhel7 qcow2. Applied all updates yum -y update Setup rhos-release rpm -ivh http://team.virt.bos.redhat.com/repos/rhos-release/rhos-release-latest.noarch.rpm; rhos-release 5 Installed packstack yum -y install openstack-packstack Did packstack all in one install packstack --allinone --os-neutron-install=n --os-ceilometer-install=n --os-horizon-install=n Install completed successfully: Applying Puppet manifests [ DONE ] Finalizing [ DONE ] **** Installation completed successfully ****** Additional information: * A new answerfile was created in: /root/packstack-answers-20140610-203026.txt * Time synchronization installation was skipped. Please note that unsynchronized time on server instances might be problem for some OpenStack components. * File /root/keystonerc_admin has been created on OpenStack client host 192.168.122.68. To use the command line tools you need to source the file. * To use Nagios, browse to http://192.168.122.68/nagios username: nagiosadmin, password: 669a8cb15ffe44d1 * The installation log file is available at: /var/tmp/packstack/20140610-203026-03r_7y/openstack-setup.log * The generated manifests are available at: /var/tmp/packstack/20140610-203026-03r_7y/manifests SELinux enforcing: [root@packstack ~]# getenforce Enforcing Same traceback/error from openstack-nova-network log: [root@packstack ~]# journalctl --full -u openstack-nova-network -- Logs begin at Tue 2014-06-10 20:28:13 EDT, end at Tue 2014-06-10 20:37:37 EDT. -- Jun 10 20:34:30 packstack.localdomain systemd[1]: Starting OpenStack Nova Network Server... Jun 10 20:34:30 packstack.localdomain systemd[1]: Started OpenStack Nova Network Server. Jun 10 20:34:31 packstack.localdomain nova-network[10630]: Traceback (most recent call last): Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/eventlet/hubs/hub.py", line 346, in fire_timers Jun 10 20:34:31 packstack.localdomain nova-network[10630]: timer() Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/eventlet/hubs/timer.py", line 56, in __call__ Jun 10 20:34:31 packstack.localdomain nova-network[10630]: cb(*args, **kw) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/eventlet/greenthread.py", line 194, in main Jun 10 20:34:31 packstack.localdomain nova-network[10630]: result = function(*args, **kwargs) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/openstack/common/service.py", line 483, in run_service Jun 10 20:34:31 packstack.localdomain nova-network[10630]: service.start() Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/service.py", line 163, in start Jun 10 20:34:31 packstack.localdomain nova-network[10630]: self.manager.init_host() Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/network/manager.py", line 1651, in init_host Jun 10 20:34:31 packstack.localdomain nova-network[10630]: self.l3driver.initialize(fixed_range=False, networks=networks) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/network/l3.py", line 91, in initialize Jun 10 20:34:31 packstack.localdomain nova-network[10630]: linux_net.ensure_metadata_ip() Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/network/linux_net.py", line 737, in ensure_metadata_ip Jun 10 20:34:31 packstack.localdomain nova-network[10630]: run_as_root=True, check_exit_code=[0, 2, 254]) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/network/linux_net.py", line 1205, in _execute Jun 10 20:34:31 packstack.localdomain nova-network[10630]: return utils.execute(*cmd, **kwargs) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/utils.py", line 164, in execute Jun 10 20:34:31 packstack.localdomain nova-network[10630]: return processutils.execute(*cmd, **kwargs) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: File "/usr/lib/python2.7/site-packages/nova/openstack/common/processutils.py", line 193, in execute Jun 10 20:34:31 packstack.localdomain nova-network[10630]: cmd=' '.join(cmd)) Jun 10 20:34:31 packstack.localdomain nova-network[10630]: ProcessExecutionError: Unexpected error while running command. Jun 10 20:34:31 packstack.localdomain nova-network[10630]: Command: sudo nova-rootwrap /etc/nova/rootwrap.conf ip addr add 169.254.169.254/32 scope link dev lo Jun 10 20:34:31 packstack.localdomain nova-network[10630]: Exit code: 1 Jun 10 20:34:31 packstack.localdomain nova-network[10630]: Stdout: '' Jun 10 20:34:31 packstack.localdomain nova-network[10630]: Stderr: 'sudo: unknown uid 996: who are you?\n' AVC from /var/log/audit/audit.log: type=AVC msg=audit(1402446871.526:2907): avc: denied { read } for pid=10682 comm="sudo" name="utmp" dev="tmpfs" ino=12245 scontext=system_u:system_r:nova_network_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file Current packages: [root@packstack ~]# rpm -q selinux-policy selinux-policy-targeted openstack-nova-network selinux-policy-3.12.1-153.el7_0.10.noarch selinux-policy-targeted-3.12.1-153.el7_0.10.noarch openstack-nova-network-2014.1-3.el7ost.noarch Momentarily switching disabling selinux allows the openstack-nova-network service to start successfully.
[root@packstack ~]# systemctl status openstack-nova-network
openstack-nova-network.service - OpenStack Nova Network Server
Loaded: loaded (/usr/lib/systemd/system/openstack-nova-network.service; enabled)
Active: inactive (dead) since Tue 2014-06-10 20:43:34 EDT; 1s ago
Process: 16145 ExecStart=/usr/bin/nova-network (code=exited, status=0/SUCCESS)
Main PID: 16145 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/openstack-nova-network.service
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: return utils.execute(*cmd, **kwargs)
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: File "/usr/lib/python2.7/site-packages/nova/utils.py", line 164, in execute
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: return processutils.execute(*cmd, **kwargs)
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: File "/usr/lib/python2.7/site-packages/nova/openstack/common/processutils.py", line 193, in execute
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: cmd=' '.join(cmd))
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: ProcessExecutionError: Unexpected error while running command.
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: Command: sudo nova-rootwrap /etc/nova/rootwrap.conf ip addr add 169.254.169.254/32 scope link dev lo
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: Exit code: 1
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: Stdout: ''
Jun 10 20:43:34 packstack.localdomain nova-network[16145]: Stderr: 'sudo: unknown uid 996: who are you?\n'
[root@packstack ~]#
[root@packstack ~]# setenforce 0
[root@packstack ~]#
[root@packstack ~]# systemctl restart openstack-nova-network
[root@packstack ~]#
[root@packstack ~]# systemctl status openstack-nova-network
openstack-nova-network.service - OpenStack Nova Network Server
Loaded: loaded (/usr/lib/systemd/system/openstack-nova-network.service; enabled)
Active: active (running) since Tue 2014-06-10 20:43:42 EDT; 1s ago
Main PID: 16165 (nova-network)
CGroup: /system.slice/openstack-nova-network.service
└─16165 /usr/bin/python /usr/bin/nova-network
Jun 10 20:43:42 packstack.localdomain systemd[1]: Starting OpenStack Nova Network Server...
Jun 10 20:43:42 packstack.localdomain systemd[1]: Started OpenStack Nova Network Server.
Jun 10 20:43:43 packstack.localdomain sudo[16172]: nova : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/nova-rootwrap /etc/nova/rootwrap.conf ip addr add 169...nk dev lo
Jun 10 20:43:43 packstack.localdomain sudo[16175]: nova : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c
Jun 10 20:43:43 packstack.localdomain sudo[16178]: nova : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/nova-rootwrap /etc/nova/rootwrap.conf iptables-restore -c
Hint: Some lines were ellipsized, use -l to show in full.
I reproduced and created a local policy using audit2allow:
module local 1.0;
require {
type initrc_var_run_t;
type passwd_file_t;
type nova_network_t;
class file { read getattr open };
}
#============= nova_network_t ==============
allow nova_network_t initrc_var_run_t:file read;
allow nova_network_t passwd_file_t:file { read getattr open };
After installing the policy I was able to run nova-network with Enforcing.
commit 67d09a639b7fc76379d3002969416e000d0676ed
Author: Miroslav Grepl <mgrepl>
Date: Wed Jun 11 10:47:40 2014 +0200
Allow nova domains to read passwd/utmp files
The AVCs / policy changes are covered by the other nova bug, except the init_read_utmp(nova_domain), which I didn't hit (different use case) ? *** This bug has been marked as a duplicate of bug 1095869 *** |