Bug 1255559

Summary:	nova api can't be started in WSGI under httpd, blocked by selinux
Product:	[Community] RDO	Reporter:	Emilien Macchi <emacchi>
Component:	openstack-selinux	Assignee:	Lon Hohberger <lhh>
Status:	CLOSED EOL	QA Contact:	Ofer Blaut <oblaut>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	srevivo
Target Milestone:	---
Target Release:	Kilo
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-19 15:52:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Emilien Macchi 2015-08-21 00:13:25 UTC

Description of problem:
Nova API can't be run under WSGI if selinux is enforced.

Version-Release number of selected component (if applicable):
openstack-selinux 0.6.35-1.el7

How reproducible:
* Install openstack-nova-api
* Install openstack-selinux
* Configure Apache & nova to run under WSGI

Actual results:
Apache won't start:
Aug 21 00:11:32 em-vag-c7-dev httpd[4405]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:8773
Aug 21 00:11:32 em-vag-c7-dev httpd[4405]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:8773

Expected results:
Apache started, listening on 8773 and 8774 tcp ports.

Additional info:
audit.log: http://paste.fedoraproject.org/257401/01157491

Comment 1 Emilien Macchi 2015-08-21 00:17:21 UTC

Please note I have the same issue for 8774:

SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8774

details here: http://paste.fedoraproject.org/257403/44011622/

Comment 2 Chandan Kumar 2016-05-19 15:52:58 UTC

This bug is against a Version which has reached End of Life.
If it's still present in supported release (http://releases.openstack.org), please update Version and reopen.