Bug 1441695

Summary: collectd_tcp_network_connect boolean must be ON.
Product: Red Hat OpenStack Reporter: Lars Kellogg-Stedman <lars>
Component: openstack-selinuxAssignee: Lon Hohberger <lhh>
Status: CLOSED ERRATA QA Contact: Leonid Natapov <lnatapov>
Severity: high Docs Contact:
Priority: high    
Version: 11.0 (Ocata)CC: lnatapov, lvrabec, mburns, mgrepl, mmagr, mmalik, mrunge, plautrba, pvrabec, rhallise, rhel-osp-director-maint, srevivo, ssekidde
Target Milestone: rcKeywords: Triaged
Target Release: 11.0 (Ocata)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-selinux-0.8.6-2.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-17 20:20:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Lars Kellogg-Stedman 2017-04-12 13:36:05 UTC
Running the collectd "memcached" plugin results in an AVC denial:

type=AVC msg=audit(1491740935.098:499216): avc:  denied  { name_connect }
for  pid=503052 comm="reader#3" dest=11211
scontext=system_u:system_r:collectd_t:s0
tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket

This connection should be allowed.

Comment 2 Red Hat Bugzilla Rules Engine 2017-04-12 13:50:31 UTC
This bugzilla has been removed from the release and needs to be reviewed and Triaged for another Target Release.

Comment 3 Matthias Runge 2017-04-18 08:22:25 UTC
setsebool -P collectd_tcp_network_connect = on 
should fix the issue.

Comment 6 Leonid Natapov 2017-05-04 10:06:16 UTC
openstack-selinux-0.8.6-2.el7ost.noarch

[root@overcloud-controller-0 heat-admin]# getsebool -a | grep  collectd
collectd_tcp_network_connect --> on

Comment 7 errata-xmlrpc 2017-05-17 20:20:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1245