Bug 1463584

Summary:

selinux error on installation

Product:

[oVirt] ovirt-vmconsole

Reporter:

Sandro Bonazzola <sbonazzo>

Component:

Packaging.rpm

Assignee:

Francesco Romani <fromani>

Status:

CLOSED CURRENTRELEASE

QA Contact:

Nikolai Sednev <nsednev>

Severity:

high

Docs Contact:

Priority:

unspecified

Version:

1.0.4

CC:

bugs, michal.skrivanek, mtessun, obockows, sbonazzo, tjelinek

Target Milestone:

ovirt-4.2.0

Keywords:

Triaged

Target Release:

---

Flags:

rule-engine: ovirt-4.2+
mtessun: planning_ack+
rule-engine: devel_ack+
rule-engine: testing_ack+

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

Doc Type:

If docs needed, set a value

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2017-12-20 11:36:03 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

Virt

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
lago logs	none

Description Sandro Bonazzola 2017-06-21 09:18:45 UTC

Selinux error while installing engine from master in ovirt-system-test:


  Installing : ovirt-vmconsole-1.0.4-1.el7.centos.noarch                163/345 
Failed to resolve booleanif statement at /etc/selinux/targeted/tmp/modules/400/ovirt_vmconsole/cil:588
semodule:  Failed!
  Installing : ovirt-vmconsole-proxy-1.0.4-1.el7.centos.noarch          164/345 
libsemanage.semanage_read_policydb: Could not open kernel policy /etc/selinux/targeted/active/policy.kern for reading. (No such file or directory).
OSError: No such file or directory

Looks like a dependency is missing, providing /etc/selinux/targeted/active/policy.kern at pre/post stage.


Seen in:
http://jenkins.ovirt.org/job/ovirt-system-tests_manual/664/artifact/exported-artifacts/lago_logs/lago.log

Comment 1 Nikolai Sednev 2017-06-21 11:09:17 UTC

Please provide a full description for this bug, including logs, what you actually did and reproduction steps.

Comment 2 Sandro Bonazzola 2017-06-21 12:48:19 UTC

Created attachment 1290059 [details]
lago logs

Comment 3 Sandro Bonazzola 2017-06-21 12:51:01 UTC

(In reply to Sandro Bonazzola from comment #2)
> Created attachment 1290059 [details]
> lago logs
Attached logs to preserve them from jenkis cleanups.


full description:
installing ovirt-vmconsole raises selinux issues as in comment #0
due to possible missing dependency in %pre / %post sections of the spec file.

I actually run ovirt-system-test in jenkins: http://jenkins.ovirt.org/job/ovirt-system-tests_manual/664

Step to reproduce: rebuild http://jenkins.ovirt.org/job/ovirt-system-tests_manual/664

Comment 4 Francesco Romani 2017-06-26 08:50:16 UTC

Thanks to the input of Sandro, I believe this happens only when the packages are installed through kickstart (or similar). We need to make sure that the last selinux-policy-targeted is installed when ovirt-vmconsole packages are installed.

This doesn't seem the case in the provided logs, hence the bug.
The fix should be simple: just add the dependency in the spec file to ensure the correct ordering.

This bug should never trigger on installed system (e.g. on CentOS), because the selinux-policy-targeted is part of basesystem.

Comment 5 Tomas Jelinek 2017-06-26 09:08:32 UTC

fix should be trivial, lets try to get it into 4.1.4

Comment 6 Sandro Bonazzola 2017-07-17 11:44:51 UTC

need info provided in comment #3

Comment 7 Tomas Jelinek 2017-08-09 07:46:36 UTC

it is a corner case and it is not so easy to verify - pushing out of z-stream due to capacity

Comment 8 Francesco Romani 2017-10-09 09:30:51 UTC

published on master

Comment 9 Nikolai Sednev 2017-10-16 15:01:55 UTC

Successfully installed ovirt-vmconsole-1.0.4-1.el7.noarch and ovirt-vmconsole-host-1.0.4-1.el7.noarch, during installation of ovirt-hosted-engine-setup-2.2.0-0.0.master.20171009203744.gitd01cc03.el7.centos.noarch on RHEL7.4 host.

Moving to verified.

Comment 10 Sandro Bonazzola 2017-12-20 11:36:03 UTC

This bugzilla is included in oVirt 4.2.0 release, published on Dec 20th 2017.

Since the problem described in this bug report should be
resolved in oVirt 4.2.0 release, published on Dec 20th 2017, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.