Bug 750271

Summary: sebool option httpd_can_network_connect doesn't persist on reboot
Product: [Retired] CloudForms Cloud Engine Reporter: James Laska <jlaska>
Component: aeolus-configureAssignee: chris alfonso <calfonso>
Status: CLOSED CURRENTRELEASE QA Contact: wes hayutin <whayutin>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 1.0.0CC: akarol, calfonso, dajohnso, deltacloud-maint, dgao, hbrock, jturner, morazi, ssachdev
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-30 17:16:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
0001-Fix-for-bug-750271.patch none

Description James Laska 2011-10-31 14:35:34 UTC 
Description of problem:

10:01:03   funzo: configure is running /usr/sbin/setsebool httpd_can_network_connect 1 but that will not persist across reboots
10:01:08   funzo: jlaska: ^
10:01:18   jlaska: ah, needs to add -P ?
10:01:27   funzo: yes, I believe that is the solution

Version-Release number of selected component (if applicable):
 * aeolus-configure-2.2.0-1.20111024205543gitf9232cc.el6.noarch

Steps to Reproduce:
1. Install RHEL6.1 and enable aeolus repos
2. Configure aeolus and get a working setup according to aeolusproject.org instructions
3. Reboot guest
4. Attempt to access conductor web

Actual results:

Fails, see /var/log/httpd/error_log details at http://fpaste.org/ODRh/

Expected results:

Should work as it did in step#2

Additional info:

 * I was able to resolve this problem by setting SELinux to permissive mode, and restarting conductor and apache.
Comment 1 James Laska 2011-10-31 14:36:44 UTC 
Created attachment 530988 [details]
0001-Fix-for-bug-750271.patch

Attached patch resolves the issue
Comment 2 chris alfonso 2011-10-31 18:58:54 UTC 
commit 5bc5588062595818f6f04fa8ee05c5151813bef1
aeolus-configure git repo
Comment 3 Aziza Karol 2011-11-23 13:06:27 UTC 
Recreated the above steps.
After rebooting I was able to access conductor web successfully.

No Error was observed in /var/log/httpd/error_log.

init.pp

  # if selinux is enabled and we want to use mod_proxy, we need todo this
  exec{'permit-http-networking':
         command => '/usr/sbin/setsebool -P httpd_can_network_connect 1',
         logoutput => true,
         unless   => "/usr/bin/test 'Disabled' = `/usr/sbin/getenforce`"
  }


[root@hp-bl490cg6-01 ~]# rpm -qa | grep aeolus
rubygem-aeolus-image-0.1.0-6.el6.noarch
rubygem-rack-mount-0.7.1-3.aeolus.el6.noarch
rubygem-aeolus-cli-0.1.0-4.el6.noarch
aeolus-conductor-doc-0.7.0-0.20111122193230git4823c2b.el6.noarch
aeolus-all-0.7.0-0.20111122193230git4823c2b.el6.noarch
rubygem-arel-2.0.10-0.aeolus.el6.noarch
aeolus-conductor-daemons-0.7.0-0.20111122193230git4823c2b.el6.noarch
aeolus-configure-2.4.0-0.20111118150133gitde3c009.el6.noarch
rubygem-ZenTest-4.3.3-2.aeolus.el6.noarch
aeolus-conductor-0.7.0-0.20111122193230git4823c2b.el6.noarch