Bug 1532275

Summary: [Selinux issues] Selinux label did not applied on ODL DPDK environment
Product: Red Hat OpenStack Reporter: Eyal Dannon <edannon>
Component: openstack-selinuxAssignee: Lon Hohberger <lhh>
Status: CLOSED ERRATA QA Contact: Maxim Babushkin <mbabushk>
Severity: high Docs Contact:
Priority: unspecified    
Version: 12.0 (Pike)CC: aadam, atheurer, fbaudin, itbrown, jianzzha, ksundara, mbabushk, mgrepl, mkolesni, oblaut, rhallise, samccann, sclewis, skramaja, srevivo, vchundur, yrachman
Target Milestone: betaKeywords: Rebase, TestOnly, Triaged
Target Release: 13.0 (Queens)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-selinux-0.8.13-1.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
N/A
Last Closed: 2018-06-27 13:41:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Eyal Dannon 2018-01-08 14:42:24 UTC
Description of problem:
Instance creation failed on ODL DPDK environment,

ERROR dropped on permission denied:

2018-01-08 13:37:22.394 1 ERROR nova.virt.libvirt.driver [req-f0244bd6-a673-4e0c-966d-3805db298af4 5541818b067d4a5a9eebb1b7c71ee9c5 67447e05062e49b7905adc5f712661c1 - default default] [instance: d9d60e55-315f-4f1a-959d-cdb676e07864] Failed to start libvirt guest: libvirtError: internal error: qemu unexpectedly closed the monitor: 2018-01-08T13:37:22.366873Z qemu-kvm: -chardev socket,id=charnet0,path=/var/lib/vhost_sockets/vhu08255778-25,server: Failed to bind socket to /var/lib/vhost_sockets/vhu08255778-25: Permission denied

audit log:
lvrabec: type=AVC msg=audit(1515418668.339:414): avc:  denied  { write } for  pid=45951 comm="qemu-kvm" name="vhost_sockets" dev="sda2" ino=562036864 scontext=system_u:system_r:svirt_t:s0:c2,c512 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir


label before resotrecon:
# ll -Zd /var/lib/vhost_sockets/
drwxr-xr-x. qemu qemu system_u:object_r:var_lib_t:s0   /var/lib/vhost_sockets/

After:
#  restorecon -Rv /var/lib/vhost_sockets/
restorecon reset /var/lib/vhost_sockets context system_u:object_r:var_lib_t:s0->system_u:object_r:virt_cache_t:s0

# ll -Zd /var/lib/vhost_sockets/
drwxr-xr-x. qemu qemu system_u:object_r:virt_cache_t:s0 /var/lib/vhost_sockets/



Version-Release number of selected component (if applicable):

# rpm -q --all | grep selinux
libselinux-python-2.5-11.el7.x86_64
container-selinux-2.33-1.git86f33cd.el7.noarch
selinux-policy-3.13.1-166.el7_4.7.noarch
openstack-selinux-0.8.11-1.el7ost.noarch
libselinux-ruby-2.5-11.el7.x86_64
libselinux-2.5-11.el7.x86_64
selinux-policy-targeted-3.13.1-166.el7_4.7.noarch
libselinux-utils-2.5-11.el7.x86_64
ceph-selinux-10.2.7-48.el7cp.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Install ODL+DPDK environment
2. Boot an instance(Get ERROR)
3. restorecon for /var/lib/vhost_sockets/
4. Boot an instance successfully  

Actual results:
Instance boot with error state

Expected results:
Instance should successfully boot

Additional info:

Comment 3 Lon Hohberger 2018-03-29 10:33:47 UTC
According to our records, this should be resolved by openstack-selinux-0.8.13-2.el7ost.  This build is available now.

Comment 8 errata-xmlrpc 2018-06-27 13:41:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2086