Bug 1053623 - openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages).
Summary: openstack-foreman-installer: openstack-selinux package is not installed on th...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-foreman-installer
Version: 4.0
Hardware: x86_64
OS: Linux
high
high
Target Milestone: z4
: 4.0
Assignee: Jiri Stransky
QA Contact: Omri Hochman
URL:
Whiteboard:
Depends On: 1049895
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-01-15 14:15 UTC by Omri Hochman
Modified: 2022-07-09 06:37 UTC (History)
5 users (show)

Fixed In Version: openstack-foreman-installer-1.0.6-1.el6ost
Doc Type: Bug Fix
Doc Text:
Cause: openstack-selinux package was not installed on nodes running OpenStack services. Consequence: SELinux AVC denials. Fix: install openstack-selinux package on nodes running OpenStack services. Result: SELinux AVC denials no longer occur.
Clone Of:
Environment:
Last Closed: 2014-05-29 20:30:32 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSP-16423 0 None None None 2022-07-09 06:37:46 UTC
Red Hat Product Errata RHSA-2014:0517 0 normal SHIPPED_LIVE Moderate: openstack-foreman-installer security, bug fix, and enhancement update 2014-05-30 00:26:29 UTC

Description Omri Hochman 2014-01-15 14:15:06 UTC
openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages). 


Steps:
------
1) Use foreman to install :
- neutron-controller. 
- nova-network controller .
2) check foreman_clients /var/log/messages 
3) check if there's opnestack-selinux installed on foreman_client machines 
('rpm -qa | grep openstack-selinux')

Results: 
----------
- Installation of neutron-controller and nova-network-controller finished successfully . 

- multiple AVCs in Errors  nder /var/log/messages 

- There's no openstack-selinux package installed on foreman_client machines.


controller with nova-network:
-----------------------------
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.362:4): avc:  denied  { write } for  pid=2510 comm="nc" name="testsock-da541e1a-b2f6-4c03-902f-cfb096abf1ab" dev=dm-0 ino=25296902 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.375:5): avc:  denied  { unmount } for  pid=2511 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:6): avc:  denied  { execute } for  pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:7): avc:  denied  { execute } for  pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.614:8): avc:  denied  { unmount } for  pid=2526 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.615:9): avc:  denied  { unmount } for  pid=2527 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 12:07:08 puma01 dbus: avc:  received policyload notice (seqno=2)
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.650:11): avc:  denied  { write } for  pid=5613 comm="nc" name="testsock-5cb67415-69db-4ef2-a192-c26fcc8228c7" dev=dm-0 ino=25296918 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.663:12): avc:  denied  { unmount } for  pid=5614 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:13): avc:  denied  { execute } for  pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:14): avc:  denied  { execute } for  pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.924:15): avc:  denied  { unmount } for  pid=5630 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.925:16): avc:  denied  { unmount } for  pid=5631 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.386:17): avc:  denied  { read write } for  pid=5860 comm="rsync" path="/tmp/puppet20140114-5505-1u4144a-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.388:18): avc:  denied  { name_connect } for  pid=5860 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.452:19): avc:  denied  { read write } for  pid=5867 comm="rsync" path="/tmp/puppet20140114-5505-18bek2f-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file

Neutron-controler: 
-------------------
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.524:276): avc:  denied  { name_connect } for  pid=24062 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.599:277): avc:  denied  { read write } for  pid=24069 comm="rsync" path="/tmp/puppet20140115-23789-38th53-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.600:278): avc:  denied  { name_connect } for  pid=24069 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.189:279): avc:  denied  { read write } for  pid=24079 comm="rsync" path="/tmp/puppet20140115-23789-11h1usl-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.190:280): avc:  denied  { name_connect } for  pid=24079 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket

Comment 2 Jiri Stransky 2014-03-31 11:19:29 UTC
I could not reproduce the AVC denials, it's possible that the selinux-policy package got fixed since this bug has been reported. Nevertheless, the openstack-selinux package should indeed be installed on nodes (unless they are running Fedora, where selinux-policy should be sufficient because it gets updated more frequently).

Submitted a pull request upstream:

https://github.com/redhat-openstack/astapor/pull/149

Comment 5 Omri Hochman 2014-04-28 16:02:32 UTC
Verified with openstack-foreman-installer-1.0.6-2.el6ost.noarch

openstack-selinux-0.1.3-2.el6ost.noarch is installed + There are no AVC's in /var/log/messages 

on the neutron-controller / neutron-networker.

Comment 8 errata-xmlrpc 2014-05-29 20:30:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-0517.html


Note You need to log in before you can comment on or make changes to this bug.