Bug 1136991

*** Bug 1136992 has been marked as a duplicate of this bug. ***

Hey, OpenStack runs on nonstandard HTTP(s) port 5000, therefore access to that resource is denied. I think we should allow this by default.

WORKAROUND is simple:

semanage boolean --on passenger_can_connect_all

Fix pending review upstream.

https://github.com/theforeman/foreman-selinux/pull/31

Og,
Can you provide logs for the other compute resources?  The fix above will only address OpenStack and team is requesting additional details.  Thanks!

Og,
Can you provide logs for the other compute resources?  The fix above will only address OpenStack and team is requesting additional details.  Thanks!

Og,
Can you provide logs for the other compute resources?  The fix above will only address OpenStack and team is requesting additional details.  Thanks!

Brad FYI: The workaround will work with any other Compute Resrouce or anything in Satellite 6 trying to connect to port that is not in our policy. The boolean will essentially open access to all remote TCP ports.

*** Bug 1144737 has been marked as a duplicate of this bug. ***

Moving to POST since upstream bug http://projects.theforeman.org/issues/7346 has been closed
-------------
Anonymous
Applied in changeset commit:24a501be208460fdfd3bc59d47a4fd2b631df622.

FAILEDQA:

*** This bug is verified in upstream.  This fix should eventually land in future downstream builds ***

# rpm -qa | grep foreman
foreman-1.6.0.47-1.el7sat.noarch
foreman-compute-1.6.0.47-1.el7sat.noarch
ruby193-rubygem-foreman_hooks-0.3.5-2.el7sat.noarch
foreman-gce-1.6.0.47-1.el7sat.noarch
ruby193-rubygem-foreman_discovery-1.3.0-2.el7sat.noarch
foreman-libvirt-1.6.0.47-1.el7sat.noarch
foreman-proxy-1.6.0.30-1.el7sat.noarch
ruby193-rubygem-foreman-redhat_access-0.0.4-2.el7sat.noarch
foreman-vmware-1.6.0.47-1.el7sat.noarch
rubygem-hammer_cli_foreman_tasks-0.0.3-3.el7sat.noarch
foreman-selinux-1.6.0.15-1.el7sat.noarch
ruby193-rubygem-foreman-tasks-0.6.9-1.1.el7sat.noarch
foreman-ovirt-1.6.0.47-1.el7sat.noarch
foreman-postgresql-1.6.0.47-1.el7sat.noarch
qe-sat6-rhel7.usersys.redhat.com-foreman-proxy-1.0-1.noarch
qe-sat6-rhel7.usersys.redhat.com-foreman-client-1.0-1.noarch
rubygem-hammer_cli_foreman-0.1.1-16.el7sat.noarch
ruby193-rubygem-foreman_bootdisk-2.0.6-1.1.el7sat.noarch


Steps to reproduce:

1. Set up Satellite 6 GA Snap 7 Compose 3
2. Attempt to add an Openstack CR
3. Test connection

Screenshot attached

Tazim, I don't believe this belongs to this BZ. I see some error message, perhaps it has something to do with X.509 certificates. To verify this bug, make sure you have no denials in the log and OpenStack works fine.

Show me output of the following please:

# getenforce

# ausearch -m AVC

Created attachment 952469 [details]
/var/log/audit/audit.log

Hi,

# getenforce
Enforcing

# ausearch -m AVC
<no matches>

Thanks

This bug is VERIFIED then, I don't know what is wrong with your setup. Must be different or new bug. Be sure to attach foreman-debug or sosreport when reporting.

Created attachment 953625 [details]
Create Openstack Compute Resource success

VERIFIED

# rpm -qa | grep foreman
foreman-1.6.0.47-1.el7sat.noarch
foreman-compute-1.6.0.47-1.el7sat.noarch
ruby193-rubygem-foreman_hooks-0.3.5-2.el7sat.noarch
foreman-gce-1.6.0.47-1.el7sat.noarch
ruby193-rubygem-foreman_discovery-1.3.0-2.el7sat.noarch
foreman-libvirt-1.6.0.47-1.el7sat.noarch
foreman-proxy-1.6.0.30-1.el7sat.noarch
ruby193-rubygem-foreman-redhat_access-0.0.4-2.el7sat.noarch
foreman-vmware-1.6.0.47-1.el7sat.noarch
rubygem-hammer_cli_foreman_tasks-0.0.3-3.el7sat.noarch
foreman-selinux-1.6.0.15-1.el7sat.noarch
ruby193-rubygem-foreman-tasks-0.6.9-1.1.el7sat.noarch
foreman-ovirt-1.6.0.47-1.el7sat.noarch
foreman-postgresql-1.6.0.47-1.el7sat.noarch
qe-sat6-rhel7.usersys.redhat.com-foreman-proxy-1.0-1.noarch
qe-sat6-rhel7.usersys.redhat.com-foreman-client-1.0-1.noarch
rubygem-hammer_cli_foreman-0.1.1-16.el7sat.noarch
ruby193-rubygem-foreman_bootdisk-2.0.6-1.1.el7sat.noarch

Added attachment

Re-opening the issue.

This gets you past *adding* the OpenStack resource but there's additional ports 
that are needed for communication for openstack to fully work.

For example, for Foreman to upload the SSH key, it needs port 8774 for Nova, which is denied:

type=AVC msg=audit(1415279429.071:43145): avc:  denied  { name_connect } for  pid=13857 comm="ruby" dest=8774 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:osapi_compute_port_t:s0 tclass=tcp_socket


There may be additional ports. 5000 is just keystone, and keystone is just the broker to other services, so if Fog has any requirement to talk to Nova Network, or any other OpenStack service you'll need those ports too.

Hey,

http://docs.openstack.org/trunk/config-reference/content/firewalls-default-ports.html

some of the ports are marked as "endpoints", some of them are marked as "publicurl". Do you have any idea which of these sholud be allowed by our SELinux policy?

Today, we only need 8774 and 5000.  I ran through adding an OS resource, assigning an image, creating a VM, and deleting the VM while running tcpdump, and only those 2 ports were contacted.

This is little bit delayed because there is a design decision issue. We need to add a port that is missing in RHEL6 and it's not yet clear how to do that to prevent upgrade error when core policy introduce it as well. Disscusions on lists.

WIP

Can I get some help putting together the rel note for this? There seems to be quite a lot to consider.

thanks

Verified so no release note required.

Tazim, Jan reproduced this recently. Can you check with him?

https://bugzilla.redhat.com/show_bug.cgi?id=1249788

This bug was fixed in Satellite 6.1.1 which was delivered on 12 August, 2015.