Bug 1267367
| Summary: | fence_virtd cannot connect remotely due to selinux | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Michele Baldessari <michele> | |
| Component: | selinux-policy | Assignee: | Simon Sekidde <ssekidde> | |
| Status: | CLOSED ERRATA | QA Contact: | Jan Zarsky <jzarsky> | |
| Severity: | low | Docs Contact: | ||
| Priority: | low | |||
| Version: | 7.1 | CC: | cfeist, cluster-maint, lvrabec, mgrepl, mhaicman, mmalik, plautrba, pvrabec, ssekidde | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-80.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1331743 (view as bug list) | Environment: | ||
| Last Closed: | 2016-11-04 02:22:47 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1262263, 1331743 | |||
Re-assigning this to selinux-policy since we're getting an avc denial when we're attempting to do normal fencing operations. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |
Description of problem: Likely this is a selinux issue, but first filing against fence-virt in case I missed something obvious. This is my /etc/fence_virt.conf: ence_virtd { listener = "multicast"; backend = "libvirt"; } listeners { multicast { key_file = "/etc/cluster/fence_xvm.key"; address = "225.0.0.12"; interface = "br-ctlplane"; } } backends { libvirt { uri = "qemu+ssh://root.122.1/system"; } } Even with the following selinux booleans set to on: setsebool -P fenced_can_ssh=on fenced_can_network_connect=on I get the following AVC: type=AVC msg=audit(1443550953.402:47395): avc: denied { setcap } for pid=31310 comm=fence_virtd" scontext=system_u:system_r:fenced_t:s0 tcontext=system_u:system_r:fenced_t:s0 tclass=process If I start fence_virtd via root or if I disable selinux it works correctly. Version-Release number of selected component (if applicable): fence-virt-0.3.2-1.el7.src.rpm selinux-policy-targeted-3.13.1-23.el7_1.18.noarch Feel free to reassign to selinux-policy if you agree with the analysis How reproducible: 100%