Bug 1136992

Summary: Can't create a CR with selinux enabled on RHEL 7
Product: Red Hat Satellite Reporter: Jason Montleon <jmontleo>
Component: SELinuxAssignee: Lukas Zapletal <lzap>
Status: CLOSED DUPLICATE QA Contact: Katello QA List <katello-qa-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.0.4   
Target Milestone: Unspecified   
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-03 19:09:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
foreman debug none

Description Jason Montleon 2014-09-03 19:08:32 UTC 
Created attachment 934209 [details]
foreman debug

Description of problem:
Trying to create a new Openstack CR in Sat 6 on RHEL 7

Version-Release number of selected component (if applicable):
Snap 7 Compose 3

How reproducible:
Always

Steps to Reproduce:
1. Set up Satellite 6 GA Snap 7 Compose 3
2. Attempt to add an Openstack CR
3. Test connection

Actual results:
Unable to save
Permission denied - connect(2) (Errno::EACCES)

Expected results:
Tenants load

Additional info:
Denial is:
type=AVC msg=audit(1409770421.707:2580): avc:  denied  { name_connect } for  pid=7002 comm="ruby" dest=5000 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:commplex_main_port_t:s0 tclass=tcp_socket

Need:
require {
	type commplex_main_port_t;
	type passenger_t;
	class tcp_socket name_connect;
}
allow passenger_t commplex_main_port_t:tcp_socket name_connect;
Comment 1 Jason Montleon 2014-09-03 19:09:45 UTC 

*** This bug has been marked as a duplicate of bug 1136991 ***