Bug 1259419

Summary: selinux is blocking ovs connections to NSX [osp-8]
Product: Red Hat OpenStack Reporter: Jaroslav Henner <jhenner>
Component: openstack-selinuxAssignee: Ryan Hallisey <rhallise>
Status: CLOSED ERRATA QA Contact: Jaroslav Henner <jhenner>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.0 (Kilo)CC: jschluet, lhh, mgrepl, nlevinki, yeylon
Target Milestone: betaKeywords: OtherQA, Triaged
Target Release: 8.0 (Liberty)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: openstack-selinux-0.6.42-1.el7ost Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1279534 1279535 1279536 1279537 (view as bug list) Environment:
Last Closed: 2016-04-07 21:06:42 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1262677    

Description Jaroslav Henner 2015-09-02 14:38:46 UTC
Description of problem:

The OVS connections to ports 6622 and 6633 seems to be blocked when Enforcing. That makes the ovs connection resets.

When Enforcing
==> /var/log/openvswitch/ovs-vswitchd.log <==
2015-09-02T14:27:35.266Z|00044|rconn|INFO|pool<->ssl:10.34.69.204:6633: connecting...
2015-09-02T14:27:35.276Z|00045|rconn|INFO|pool<->ssl:10.34.69.204:6633: connected
2015-09-02T14:27:35.279Z|00046|rconn|INFO|pool<->ssl:10.34.69.204:6633: connection closed by peer
2015-09-02T14:27:35.279Z|00047|rconn|INFO|pool<->ssl:10.34.69.204:6633: waiting 2 seconds before reconnect
2015-09-02T14:27:36.265Z|00048|rconn|INFO|br-int<->unix:ovs-l3d.mgmt: connecting...
2015-09-02T14:27:36.265Z|00049|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory)
2015-09-02T14:27:36.265Z|00050|rconn|INFO|br-int<->unix:ovs-l3d.mgmt: waiting 4 seconds before reconnect

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1441204057.176:32748): avc:  denied  { name_connect } for  pid=23947 comm="ovsdb-server" dest=6632 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1441204057.176:32748): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fffb06074c0 a2=10 a3=0 items=0 ppid=23946 pid=23947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ovsdb-server" exe="/usr/sbin/ovsdb-server" subj=system_u:system_r:openvswitch_t:s0 key=(null)

==> /var/log/openvswitch/ovs-vswitchd.log <==
2015-09-02T14:27:37.266Z|00051|rconn|INFO|pool<->ssl:10.34.69.204:6633: connecting...
2015-09-02T14:27:37.275Z|00052|rconn|INFO|pool<->ssl:10.34.69.204:6633: connected
2015-09-02T14:27:37.275Z|00053|rconn|INFO|pool<->ssl:10.34.69.204:6633: connection closed by peer
2015-09-02T14:27:37.275Z|00054|rconn|INFO|pool<->ssl:10.34.69.204:6633: waiting 4 seconds before reconnect

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1441204059.140:32749): avc:  denied  { search } for  pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir
type=SYSCALL msg=audit(1441204059.140:32749): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null)



After setenforce 0
==> /var/log/audit/audit.log <==
type=AVC msg=audit(1441204354.383:32858): avc:  denied  { search } for  pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir
type=SYSCALL msg=audit(1441204354.383:32858): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null)

==> /var/log/openvswitch/ovs-vswitchd.log <==
2015-09-02T14:32:36.266Z|00150|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory)

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1441204359.384:32859): avc:  denied  { search } for  pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir
type=SYSCALL msg=audit(1441204359.384:32859): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null)
type=MAC_STATUS msg=audit(1441204360.325:32860): enforcing=0 old_enforcing=1 auid=0 ses=1919
type=SYSCALL msg=audit(1441204360.325:32860): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff13424aa0 a2=1 a3=7fff13424820 items=0 ppid=21103 pid=24330 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1919 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

==> /var/log/openvswitch/ovs-vswitchd.log <==
2015-09-02T14:32:44.266Z|00151|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory)

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1441204364.388:32861): avc:  denied  { getattr } for  pid=23982 comm="system_stats4" path="/srv/node/swiftloopback" dev="loop0" ino=2 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir
type=SYSCALL msg=audit(1441204364.388:32861): arch=c000003e syscall=4 success=yes exit=0 a0=7f14a3ffd8db a1=7f14a3ffd740 a2=7f14a3ffd740 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null)                                                                


Version-Release number of selected component (if applicable):
openstack-selinux-0.6.37-1.el7ost.noarch


How reproducible:
always


Steps to Reproduce:
1.
2.
3.

Actual results:
ovs unable to connect to NSX

Expected results:
ovs unable connect to NSX both - management and controller connections

Additional info:

Comment 7 nlevinki 2016-04-06 07:30:13 UTC
We don't have a licence for nsx moving to OtherQA

Comment 9 errata-xmlrpc 2016-04-07 21:06:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html