Bug 1243039
| Summary: | Undercloud deployment with SSL fails over SELinux enforcing (over: keepalived) | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Omri Hochman <ohochman> | ||||||||
| Component: | openstack-selinux | Assignee: | Lon Hohberger <lhh> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Alexander Chuzhoy <sasha> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | 7.0 (Kilo) | CC: | bperkins, calfonso, dwalsh, jschluet, jslagle, kbasil, lhh, mburns, mgrepl, rhel-osp-director-maint, sasha, sclewis, yeylon | ||||||||
| Target Milestone: | ga | ||||||||||
| Target Release: | 7.0 (Kilo) | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | openstack-selinux-0.6.37-1.el7ost | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | 1242660 | Environment: | |||||||||
| Last Closed: | 2015-08-05 13:29:30 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Omri Hochman
2015-07-14 15:27:58 UTC
Created attachment 1052381 [details]
audit.log from permissive run
#============= keepalived_t ==============
allow keepalived_t cgroup_t:dir { read search open };
allow keepalived_t cgroup_t:file { read getattr open };
allow keepalived_t init_t:unix_stream_socket connectto;
allow keepalived_t syslogd_var_run_t:dir read;
allow keepalived_t syslogd_var_run_t:file { read getattr open };
allow keepalived_t systemd_systemctl_exec_t:file { read getattr open execute execute_no_trans };
allow keepalived_t tmpfs_t:filesystem getattr;
What Services is keepalived trying to restart? Any reason that systemd does not do this itself? Created attachment 1052789 [details]
Patch
Created attachment 1052792 [details]
Patch w/ unit test
Verified: FailedQA
Environment:
openstack-selinux-0.6.36-1.el7ost.noarch
The following is shown in the audit.log when running "openstack undercloud install" with selinux is enforced:
type=USER_AVC msg=audit(1437078679.793:1574): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/haproxy.service" scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:haproxy_unit_file_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1437078681.794:1580): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/haproxy.service" scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:haproxy_unit_file_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Patch should be simply allowing this for keepalived: systemd_status_all_unit_files Respinned with a simpler policy that transitions to a keepalived-specific, unconfined domain when executing systemctl from keepalived. This prevents (presumably) systemd from throwing a USER_AVC when keepalived_t requests status for a service, and is not haproxy-specific. Dan, the configuration is effectively a 1-node load balancer that uses keepalived to monitor haproxy. When haproxy is active, keepalived starts to VIPs that then are used by haproxy so haproxy can perform HTTPS termination or plain-hane HTTP forwarding to local openstack services. I'm not sure why this configuration was chosen over a simpler configuration where systemd monitors/restarts haproxy itself and have the system start the VIPs on startup (obviating the need for keepalived). Verified: Environment: instack-undercloud-2.1.2-21.el7ost.noarch 1. Enabled SSL on the undercloud 2. Copied the cert file test.pem to /etc/haproxy dir 3. Edited the undercloud.conf file with "undercloud_service_certificate = /etc/haproxy/test.pem" 4. Ran "openstack undercloud install" The undercloud deployment completed with no errors. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2015:1548 |