Bug 1572510

SElinux is preventing dpdkvhostuserclient ports to be accessed by ovs on the directory /var/lib/vhost_sockets.

Probably related to BZ #1561729, I also see lot of ovs logs. I will attach the sos-report.


[root@overcloud-compute-0 heat-admin]# ll /var/lib/vhost_sockets/ -dZ
drwxrwxr-x. qemu hugetlbfs system_u:object_r:virt_cache_t:s0 /var/lib/vhost_sockets/
[root@overcloud-compute-0 heat-admin]# ll /var/lib/vhost_sockets/ -Z
srwxrwxr-x. qemu hugetlbfs system_u:object_r:virt_cache_t:s0 vhu66209262-ab


[root@overcloud-compute-0 heat-admin]# rpm -qa | grep 'selinux\|openvswitch'
selinux-policy-targeted-3.13.1-192.el7_5.3.noarch
libselinux-ruby-2.5-12.el7.x86_64
openvswitch-ovn-central-2.6.1-28.git20180130.el7ost.x86_64
container-selinux-2.55-1.el7.noarch
python-openvswitch-2.9.0-19.el7fdp.noarch
openvswitch-2.9.0-19.el7fdp.x86_64
ceph-selinux-10.2.10-17.el7cp.x86_64
libselinux-python-2.5-12.el7.x86_64
selinux-policy-3.13.1-192.el7_5.3.noarch
openstack-selinux-0.8.14-1.el7ost.noarch
openstack-neutron-openvswitch-9.4.1-16.el7ost.noarch
libselinux-utils-2.5-12.el7.x86_64
openvswitch-ovn-host-2.9.0-19.el7fdp.x86_64
libselinux-2.5-12.el7.x86_64
openvswitch-ovn-common-2.9.0-19.el7fdp.x86_64
[root@overcloud-compute-0 heat-admin]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.5 (Maipo)

Created attachment 1427579 [details]
compute selinux vhost socket issue

The AVCs in the audit.log (from the sosreport) do not appear directly related to vhost_sockets / virt_cache_t.

There are these errors in the system logs:

Apr 27 03:56:01 overcloud-compute-0 ovs-vswitchd[11431]: ovs|00005|dpdk|ERR|VHOST_CONFIG: truncted msg
Apr 27 03:56:01 overcloud-compute-0 ovs-vswitchd[11431]: ovs|00006|dpdk|ERR|VHOST_CONFIG: vhost read message failed

However, there are no obvious (to me) corresponding AVCs in /var/log/audit/audit.log that would explain them. ovs-vswitchd runs as 'openvswitch_t'.

There are other AVCs which appear unrelated.

You might try running with SELinux in permissive with dontaudit rules disabled and capturing that sosreport.  That might help identify the problem.

Also, a that truncated read should not result in ovs-vswitchd going into a flat spin and spewing millions of errors to syslog, but that's not related to this bug.

(In reply to Lon Hohberger from comment #4)
> You might try running with SELinux in permissive with dontaudit rules
> disabled and capturing that sosreport.  That might help identify the problem.
Can you elaborate on the steps and commands to be executed to disable dontaudit rules and capture sosreport?

> 
> Also, a that truncated read should not result in ovs-vswitchd going into a
> flat spin and spewing millions of errors to syslog, but that's not related
> to this bug.
VM is in the pause state SELinux is Enforcing and ovs dumps these logs. The moment it changed to permissive, VM moves to active state and ovs stops dumping logs. This the only reason for treating it as related to SELinux.

By disabling the dontaudit module, below is the error in the audit.log, I will attach an sosreport.

--------------------------------------------------
[root@overcloud-compute-0 heat-admin]# semodule --disable_dontaudit --build
[root@overcloud-compute-0 heat-admin]# getenforce
Enforcing
--------------------------------------------------

type=AVC msg=audit(1525078048.180:1080085): avc:  denied  { read write } for  pid=11438 comm="ovs-vswitchd" path="socket:[38232802]" dev="sockfs" ino=38232802 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:svirt_t:s0:c14,c629 tclass=unix_stream_socket

--------------------------------------------------

Created attachment 1428734 [details]
sosreport dontaudit enforcing

Confirmed; the only AVCs I see in the new audit.log are as in comment #6.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2102