Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1053623

Summary: openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages).
Product: Red Hat OpenStack Reporter: Omri Hochman <ohochman>
Component: openstack-foreman-installerAssignee: Jiri Stransky <jstransk>
Status: CLOSED ERRATA QA Contact: Omri Hochman <ohochman>
Severity: high Docs Contact:
Priority: high    
Version: 4.0CC: breeler, jguiditt, morazi, rhos-maint, yeylon
Target Milestone: z4Keywords: ZStream
Target Release: 4.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: openstack-foreman-installer-1.0.6-1.el6ost Doc Type: Bug Fix
Doc Text:
Cause: openstack-selinux package was not installed on nodes running OpenStack services. Consequence: SELinux AVC denials. Fix: install openstack-selinux package on nodes running OpenStack services. Result: SELinux AVC denials no longer occur.
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-29 20:30:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1049895    
Bug Blocks:    

Description Omri Hochman 2014-01-15 14:15:06 UTC
openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages). 


Steps:
------
1) Use foreman to install :
- neutron-controller. 
- nova-network controller .
2) check foreman_clients /var/log/messages 
3) check if there's opnestack-selinux installed on foreman_client machines 
('rpm -qa | grep openstack-selinux')

Results: 
----------
- Installation of neutron-controller and nova-network-controller finished successfully . 

- multiple AVCs in Errors  nder /var/log/messages 

- There's no openstack-selinux package installed on foreman_client machines.


controller with nova-network:
-----------------------------
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.362:4): avc:  denied  { write } for  pid=2510 comm="nc" name="testsock-da541e1a-b2f6-4c03-902f-cfb096abf1ab" dev=dm-0 ino=25296902 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.375:5): avc:  denied  { unmount } for  pid=2511 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:6): avc:  denied  { execute } for  pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:7): avc:  denied  { execute } for  pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.614:8): avc:  denied  { unmount } for  pid=2526 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.615:9): avc:  denied  { unmount } for  pid=2527 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 12:07:08 puma01 dbus: avc:  received policyload notice (seqno=2)
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.650:11): avc:  denied  { write } for  pid=5613 comm="nc" name="testsock-5cb67415-69db-4ef2-a192-c26fcc8228c7" dev=dm-0 ino=25296918 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.663:12): avc:  denied  { unmount } for  pid=5614 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:13): avc:  denied  { execute } for  pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:14): avc:  denied  { execute } for  pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.924:15): avc:  denied  { unmount } for  pid=5630 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.925:16): avc:  denied  { unmount } for  pid=5631 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.386:17): avc:  denied  { read write } for  pid=5860 comm="rsync" path="/tmp/puppet20140114-5505-1u4144a-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.388:18): avc:  denied  { name_connect } for  pid=5860 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.452:19): avc:  denied  { read write } for  pid=5867 comm="rsync" path="/tmp/puppet20140114-5505-18bek2f-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file

Neutron-controler: 
-------------------
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.524:276): avc:  denied  { name_connect } for  pid=24062 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.599:277): avc:  denied  { read write } for  pid=24069 comm="rsync" path="/tmp/puppet20140115-23789-38th53-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.600:278): avc:  denied  { name_connect } for  pid=24069 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.189:279): avc:  denied  { read write } for  pid=24079 comm="rsync" path="/tmp/puppet20140115-23789-11h1usl-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file
Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.190:280): avc:  denied  { name_connect } for  pid=24079 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket

Comment 2 Jiri Stransky 2014-03-31 11:19:29 UTC
I could not reproduce the AVC denials, it's possible that the selinux-policy package got fixed since this bug has been reported. Nevertheless, the openstack-selinux package should indeed be installed on nodes (unless they are running Fedora, where selinux-policy should be sufficient because it gets updated more frequently).

Submitted a pull request upstream:

https://github.com/redhat-openstack/astapor/pull/149

Comment 5 Omri Hochman 2014-04-28 16:02:32 UTC
Verified with openstack-foreman-installer-1.0.6-2.el6ost.noarch

openstack-selinux-0.1.3-2.el6ost.noarch is installed + There are no AVC's in /var/log/messages 

on the neutron-controller / neutron-networker.

Comment 8 errata-xmlrpc 2014-05-29 20:30:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-0517.html