Bug 1364024

Summary:	SELinux prevents CDS and HA proxy instances from being added (RHEL 6 only)
Product:	Red Hat Update Infrastructure for Cloud Providers	Reporter:	Radek Bíba <rbiba>
Component:	Tools	Assignee:	Patrick Creech <pcreech>
Status:	CLOSED ERRATA	QA Contact:	Vratislav Hutsky <vhutsky>
Severity:	high	Docs Contact:
Priority:	high
Version:	3.0.0	CC:	bkearney, igulina, pcreech
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1363978	Environment:
Last Closed:	2017-03-01 22:12:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1308349

Description Radek Bíba 2016-08-04 10:13:08 UTC

+++ This bug was initially created as a clone of Bug #1363978 +++

Description of problem:
A new CDS is added with an error. Further actions in rhui-manager are possible, though.

Version-Release number of selected component (if applicable):
RHEL6 iso 20160727 on NFS

How reproducible:
always

Steps to Reproduce:
1. add a new CDS

Actual results:
Similar to https://bugzilla.redhat.com/attachment.cgi?id=1187393 (attached to bug 1363978) but the error occurs earlier in the process:

sudo() received nonzero return code 1 while executing!

Requested: cp -r /var/lib/puppet/ssl/certificate_requests/cds01.eu-west-1.compute.internal.pem /home/ec2-user/cds01.eu-west-1.compute.internal.pem
Executed: sudo -S -p 'sudo password:'  /bin/bash -l -c "cp -r /var/lib/puppet/ssl/certificate_requests/cds01.eu-west-1.compute.internal.pem /home/ec2-user/cds01.eu-west-1.compute.internal.pem"

============================================================================== Standard output ==============================================================================

cp: cannot stat `/var/lib/puppet/ssl/certificate_requests/cds01.eu-west-1.compute.internal.pem': No such file or directory

=============================================================================================================================================================================

Expected results:
No error

Comment 1 Radek Bíba 2016-08-04 10:23:38 UTC

I might add that the /var/lib/puppet/ssl/certificate_requests/ directory is empty. No other .pem file that could/should be used instead is in it.

Comment 3 Radek Bíba 2016-08-05 06:59:27 UTC

The same problem occurs while adding a new HA proxy:

sudo() received nonzero return code 1 while executing!

Requested: cp -r /var/lib/puppet/ssl/certificate_requests/hap01.eu-west-1.compute.internal.pem /home/ec2-user/hap01.eu-west-1.compute.internal.pem
Executed: sudo -S -p 'sudo password:'  /bin/bash -l -c "cp -r /var/lib/puppet/ssl/certificate_requests/hap01.eu-west-1.compute.internal.pem /home/ec2-user/hap01.eu-west-1.compute.internal.pem"

============================================================================== Standard output ==============================================================================

cp: cannot stat `/var/lib/puppet/ssl/certificate_requests/hap01.eu-west-1.compute.internal.pem': No such file or directory

=============================================================================================================================================================================

Comment 4 Radek Bíba 2016-08-08 11:26:33 UTC

FWIW, on the CDS:

# locate cds01.eu-west-1.compute.internal.pem
/var/lib/puppet/ssl/private_keys/cds01.eu-west-1.compute.internal.pem
/var/lib/puppet/ssl/public_keys/cds01.eu-west-1.compute.internal.pem

Not sure which one (if either of them) was supposed to be in /var/lib/puppet/ssl/certificate_requests.

Comment 6 Irina Gulina 2016-09-09 13:45:16 UTC

Reproduced on RHEL6 NFS and Gluster 20160830

Comment 7 Radek Bíba 2016-09-22 10:19:29 UTC

Everything works fine in Enforcing mode with RHUI-3.0-RHEL-6-20160921.n.0. Thanks Patrick!

Comment 8 errata-xmlrpc 2017-03-01 22:12:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0367