Prior to this update, SELinux was preventing neutron from using the file system. As a consequence, neutron failed to run. Now, an appropriate rule has been added to SELinux, which allows neutron to run with SELinux in enforcing mode.
Description of problem:
Running rhel7.1 with rhos5 .
From audit.log :
11:21:30 10.35.182.167|check_errors_post_test<<<--|14505:type=AVC msg=audit(1419326478.236:14309): avc: denied { getattr } for pid=32013 comm="neutron-ns-meta" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
Attaching full log file from automation run ,
Thanks ,
Benny
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
[root@rhel7 ~]# audit2why -i tmp.in
type=AVC msg=audit(1419326478.236:14309): avc: denied { getattr } for pid=32013 comm="neutron-ns-meta" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
Was caused by:
Unknown - would be allowed by active policy
Possible mismatch between this policy and the one under which the audit message was generated.
Possible mismatch between current in-memory boolean settings vs. permanent ones.
[root@rhel7 ~]# rpm -q openstack-selinux
openstack-selinux-0.6.37-1.el7ost.noarch
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2015-1762.html
Description of problem: Running rhel7.1 with rhos5 . From audit.log : 11:21:30 10.35.182.167|check_errors_post_test<<<--|14505:type=AVC msg=audit(1419326478.236:14309): avc: denied { getattr } for pid=32013 comm="neutron-ns-meta" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem Attaching full log file from automation run , Thanks , Benny Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: