Bug 988519
Summary: | cron jobs fail due to selinux context mismatch | |||
---|---|---|---|---|
Product: | OpenShift Online | Reporter: | Andy Grimm <agrimm> | |
Component: | Containers | Assignee: | Rob Millner <rmillner> | |
Status: | CLOSED CURRENTRELEASE | QA Contact: | libra bugs <libra-bugs> | |
Severity: | unspecified | Docs Contact: | ||
Priority: | unspecified | |||
Version: | 2.x | CC: | bmeng, chunchen, jgoulding, mfisher, qiuzhang, rmillner, xtian | |
Target Milestone: | --- | |||
Target Release: | --- | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | Doc Type: | Bug Fix | ||
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 1003645 (view as bug list) | Environment: | ||
Last Closed: | 2013-08-07 22:56:44 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1003645 |
Description
Andy Grimm
2013-07-25 18:40:42 UTC
I don't know whether it's the _correct_ fix, but one possible fix would be to change the runcon invocation in daemon_as_user in oo-scheduled-jobs. It currently has: daemon --user="$uuid" runcon -r system_r -t openshift_t -l $mcs_level "$@" which could be: daemon --user="$uuid" runcon -u unconfined_u -r system_r -t openshift_t -l $mcs_level "$@" Implemented the above fix: https://github.com/openshift/origin-server/pull/3173 Stopping gear... CLIENT_RESULT: Stopping CRON cart Waiting for stop to finish Starting gear... App container start_gear CLIENT_RESULT: Starting CRON cart __________________________________________________________________________ Thu Jul 25 16:40:11 EDT 2013: END minutely cron run - status=0 __________________________________________________________________________ Commit pushed to master at https://github.com/openshift/origin-server https://github.com/openshift/origin-server/commit/d1f0ecc25c07ef8c1c9aaabc616b3e4353bedd22 Bug 988519 - Ensure that the gear task runs as unconfined_u. It's fixed, verified on devenv_3572, please refer to the following results: 1. create an app which has the "cron" cartridge installed 2. add a script called .openshift/cron/minutely/restart.sh to your git repo with these contents and git push: #!/bin/sh gear stop gear start 3. ssh into this app and check the cron log \> cat ./cron/log/cron.minutely.log Stopping gear... CLIENT_RESULT: Stopping CRON cart Waiting for stop to finish Starting gear... CLIENT_RESULT: Starting CRON cart __________________________________________________________________________ Mon Jul 29 01:40:14 EDT 2013: END minutely cron run - status=0 __________________________________________________________________________ |