Bug 1393440

Summary: Upgrade Step: start_databases fails to start mongod
Product: Red Hat Satellite Reporter: Lukas Pramuk <lpramuk>
Component: SELinuxAssignee: Lukas Zapletal <lzap>
Status: CLOSED NOTABUG QA Contact: Lukas Pramuk <lpramuk>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3.0   
Target Milestone: Unspecified   
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-09 15:47:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Lukas Pramuk 2016-11-09 14:56:52 UTC
Description of problem:
Upgrade Step: start_databases fails to start mongod.
It is caused by SELinux denial.

Version-Release number of selected component (if applicable):
satellite-6.3.0-6.1.beta.el7sat.noarch

How reproducible:
100%

Steps to Reproduce:
1. # satellite-installer --upgrade
Upgrading...
Upgrade Step: stop_services...
...


Upgrade Step: start_databases...
Redirecting to /bin/systemctl start  mongod.service
Job for mongod.service failed because the control process exited with error code. See "systemctl status mongod.service" and "journalctl -xe" for details.

Redirecting to /bin/systemctl start  postgresql.service

Some services failed to start: mongod

Upgrade step start_databases failed. Check logs for more information.

Actual results:
mongod failed to start

Expected results:
mongod is starting

Additional info:
# less /var/log/mongodb/mongodb.log:
...
2016-11-09T09:52:07.632-0500 ***** SERVER RESTARTED *****
2016-11-09T09:52:07.637-0500 ERROR: Cannot write pid file to /var/run/mongodb/mongod.pid: Permission denied

# ls -Z /var/run/mongodb/mongod.pid
-rw-r--r--. mongodb mongodb system_u:object_r:svirt_sandbox_file_t:s0 /var/run/mongodb/mongod.pid

# restorecon -rv /var/run/mongodb/mongod.pid
<nothing happened>

# audit2allow -a 

#============= mongod_t ==============
allow mongod_t svirt_sandbox_file_t:dir search;

#!!!! The file '/run/mongodb/mongod.pid' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /run/mongodb/mongod.pid
allow mongod_t svirt_sandbox_file_t:file { open write };

Comment 1 Lukas Pramuk 2016-11-09 14:58:50 UTC
RHEL7.3 SELinux

Comment 2 Lukas Pramuk 2016-11-09 15:11:27 UTC
Very strange !!!

# chcon -t var_run_t /var/run/mongodb/mongod.pid
# restorecon -rv /var/run/mongodb/mongod.pid
restorecon reset /run/mongodb/mongod.pid context system_u:object_r:var_run_t:s0->system_u:object_r:mongod_var_run_t:s0

After changing to var_run_t restorecon resets fcontext to mongod_var_run_t

Comment 3 Lukas Pramuk 2016-11-09 15:47:36 UTC
We better close this wild bug.