Bug 1281588

Summary: Uploading nova pub key to overcloud fails due to SELinux
Product: Red Hat OpenStack Reporter: Marius Cornea <mcornea>
Component: openstack-selinuxAssignee: Ryan Hallisey <rhallise>
Status: CLOSED ERRATA QA Contact: Marius Cornea <mcornea>
Severity: high Docs Contact:
Priority: high    
Version: 8.0 (Liberty)CC: jschluet, lhh, mburns, mgrepl, oblaut, rbiba, rhel-osp-director-maint, rrasouli, sasha, sgordon, yeylon
Target Milestone: betaKeywords: Triaged
Target Release: 8.0 (Liberty)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-selinux-0.6.45-1.el7ost Doc Type: Bug Fix
Doc Text:
Prior to this update, SELinux prevented nova from uploading the public key to the overcloud. A new rule has now been added to allow nova to upload the key.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2016-04-07 21:12:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marius Cornea 2015-11-12 21:18:49 UTC 
Description of problem:
Uploading nova pub key to overcloud doesn't work due to SELinux.

Version-Release number of selected component (if applicable):
openstack-selinux-0.6.42-2.el7ost.noarch

How reproducible:
100%

Steps to Reproduce:
1. source overcloudrc
2. nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey

Actual results:
ERROR (ConnectionRefused): Unable to establish connection to http://172.16.23.10:8774/v2/65d09be812be4d3a8853ac225706d1a9/os-keypairs

Expected results:
Upload succeeds.

Additional info:
type=AVC msg=audit(1447363073.695:606): avc:  denied  { execmem } for  pid=3820 comm="nova-api" scontext=system_u:system_r:nova_t:s0 tcontext=system_u:system_r:nova_t:s0 tclass=process
type=SYSCALL msg=audit(1447363073.695:606): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=1000 a2=7 a3=22 items=0 ppid=3771 pid=3820 auid=4294967295 uid=162 gid=162 euid=162 suid=162 fsuid=162 egid=162 sgid=162 fsgid=162 tty=(none) ses=4294967295 comm="nova-api" exe="/usr/bin/python2.7" subj=system_u:system_r:nova_t:s0 key=(null)
type=ANOM_ABEND msg=audit(1447363073.697:607): auid=4294967295 uid=162 gid=162 ses=4294967295 subj=system_u:system_r:nova_t:s0 pid=3820 comm="nova-api" reason="memory violation" sig=11
Comment 2 Miroslav Grepl 2015-11-13 07:35:30 UTC 
See http://www.akkadia.org/drepper/selinux-mem.html
Comment 3 Ryan Hallisey 2015-11-18 17:08:44 UTC 
I added optional policy to deal with this for now.  Would probably be best to go with mirek's solution for the future.
Comment 7 Ronnie Rasouli 2016-01-31 20:45:30 UTC 
[stack@instack ~]$ nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey
[stack@instack ~]$ nova keypair-list
+---------+-------------------------------------------------+
| Name    | Fingerprint                                     |
+---------+-------------------------------------------------+
| userkey | c9:38:8e:6c:06:bd:2a:9f:f4:ac:ab:ff:c7:58:73:00 |
+---------+-------------------------------------------------+
openstack-selinux-0.6.52-1.el7ost.noarch
Comment 8 errata-xmlrpc 2016-04-07 21:12:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html