Bug 1402926

Summary:	openstack-selinux-0.7.12-1 breaks running keystone behind httpd
Product:	Red Hat OpenStack	Reporter:	Alex Schultz <aschultz>
Component:	openstack-selinux	Assignee:	Ryan Hallisey <rhallise>
Status:	CLOSED ERRATA	QA Contact:	Udi Shkalim <ushkalim>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	11.0 (Ocata)	CC:	apevec, dmsimard, jpena, lhh, mburns, mgrepl, nlevinki, rhallise, srevivo
Target Milestone:	z1	Keywords:	Triaged, ZStream
Target Release:	10.0 (Newton)
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openstack-selinux-0.7.13-3.el7ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-02-01 14:36:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alex Schultz 2016-12-08 16:17:46 UTC

Description of problem:
With openstack-selinux-0.7.12-1.el7.noarch installed, httpd cannot listen to port 5000 to run keystone so it fails to start. downgrading to openstack-selinux-0.7.4-2.el7.noarch allows httpd to start.

Version-Release number of selected component (if applicable):
openstack-selinux-0.7.4-2.el7.noarch

How reproducible:
Always

Steps to Reproduce:
1. install httpd, openstack-selinux-0.7.12-1
2. configure httpd to listen on port 5000
3. attempt to start httpd

Actual results:
httpd fails to start

Expected results:
httpd should be able to listen on  port 5000

Additional info:

Comment 1 Alex Schultz 2016-12-08 16:21:36 UTC

type=AVC msg=audit(1481210263.956:2156): avc:  denied  { name_bind } for  pid=19937 comm="httpd" src=5000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:commplex_main_port_t:s0 tclass=tcp_socket

Comment 2 Javier Peña 2016-12-09 10:19:34 UTC

openstack-selinux-0.7.12-1 seems to depend on RHEL 7.3 bits.

I have found a similar issue with Packstack on CentOS 7.2, and it was fixed by updating selinux-policy to version 3.13.1-102 (using the CentOS CR repository).

Comment 3 Alan Pevec 2016-12-09 10:43:54 UTC

Please push upstream to https://github.com/redhat-openstack/openstack-selinux/commits/el7-rpm (which is now very out of sync) or let know and I'll do the specfile sync.

Comment 4 Ryan Hallisey 2016-12-09 13:16:54 UTC

https://github.com/redhat-openstack/openstack-selinux/commit/c8c013c0aa74aa161672ed1688817a1f45deaf2f

Just added 0.7.13-2

Comment 7 nlevinki 2017-01-25 10:40:37 UTC

https://rhos-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/view/RHOS/view/RHOS10/job/qe-phase2-10_director-rhel-7.3-virthost-3cont_2comp-ipv4-vxlan-lvm-external-loadbalancer/63/

Comment 9 errata-xmlrpc 2017-02-01 14:36:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0233.html