Bug 1766739

Summary: unable to write ifcfg file to /etc/sysconfig/network-scripts/ due to bad SELinux labeling
Product: OpenShift Container Platform Reporter: Micah Abbott <miabbott>
Component: RHCOSAssignee: Colin Walters <walters>
Status: CLOSED ERRATA QA Contact: Michael Nguyen <mnguyen>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 4.3.0CC: bbreard, dustymabe, imcleod, jligon, nstielau
Target Milestone: ---   
Target Release: 4.3.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1766740 (view as bug list) Environment:
Last Closed: 2020-01-23 11:09:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1766740    

Description Micah Abbott 2019-10-29 18:53:32 UTC 
In BZ#1766161, the following was reported

(2019-10-29 15:13:10,455 root         ERROR    NM main-loop aborted: Connection update failed: error=nm-settings-error-quark: failed to update connection: Could not open file '/etc/sysconfig/network-scripts/ifcfg-ens3' for writing: Permission denied (3), dev=ens3/<enum NM_DEVICE_STATE_ACTIVATED of type NM.DeviceState>)

Additional investigation via Slack found:

```
type=AVC msg=audit(1572361975.953:149): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
type=AVC msg=audit(1572361983.181:151): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
type=AVC msg=audit(1572361990.452:152): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
```

We need to relabel the ifcfg files that get persisted as part of ignition-dracut
Comment 1 Micah Abbott 2019-11-01 20:09:05 UTC 
The fix should be present in `ignition-0.33.0-9.rhaos4.3.git3625532.el8` and RHCOS builds after `43.81.201911011508.0`
Comment 4 Michael Nguyen 2019-11-20 17:29:00 UTC 
Verified on 4.3.0-0.nightly-2019-11-19-122017

$ oc debug node/ip-10-0-129-117.ec2.internal 
Starting pod/ip-10-0-129-117ec2internal-debug ...
To use host binaries, run `chroot /host`
chroot /host
If you don't see a command prompt, try pressing enter.
chroot /host

# ls -alZ /etc/sysconfig/network-scripts
total 4
drwxr-xr-x. 2 root root system_u:object_r:net_conf_t:s0    6 Nov 20 16:18 .
drwxr-xr-x. 3 root root system_u:object_r:etc_t:s0      4096 Nov 20 16:18 ..
# rpm -q ignition         
ignition-0.33.0-13.rhaos4.3.git3625532.el8.x86_64
sh-4.4# exit
exit
sh-4.2# exit
exit

Removing debug pod ...
Comment 6 errata-xmlrpc 2020-01-23 11:09:46 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062