openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages). Steps: ------ 1) Use foreman to install : - neutron-controller. - nova-network controller . 2) check foreman_clients /var/log/messages 3) check if there's opnestack-selinux installed on foreman_client machines ('rpm -qa | grep openstack-selinux') Results: ---------- - Installation of neutron-controller and nova-network-controller finished successfully . - multiple AVCs in Errors nder /var/log/messages - There's no openstack-selinux package installed on foreman_client machines. controller with nova-network: ----------------------------- Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.362:4): avc: denied { write } for pid=2510 comm="nc" name="testsock-da541e1a-b2f6-4c03-902f-cfb096abf1ab" dev=dm-0 ino=25296902 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.375:5): avc: denied { unmount } for pid=2511 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:6): avc: denied { execute } for pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:7): avc: denied { execute } for pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.614:8): avc: denied { unmount } for pid=2526 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.615:9): avc: denied { unmount } for pid=2527 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 12:07:08 puma01 dbus: avc: received policyload notice (seqno=2) Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.650:11): avc: denied { write } for pid=5613 comm="nc" name="testsock-5cb67415-69db-4ef2-a192-c26fcc8228c7" dev=dm-0 ino=25296918 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.663:12): avc: denied { unmount } for pid=5614 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:13): avc: denied { execute } for pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:14): avc: denied { execute } for pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.924:15): avc: denied { unmount } for pid=5630 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.925:16): avc: denied { unmount } for pid=5631 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.386:17): avc: denied { read write } for pid=5860 comm="rsync" path="/tmp/puppet20140114-5505-1u4144a-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.388:18): avc: denied { name_connect } for pid=5860 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.452:19): avc: denied { read write } for pid=5867 comm="rsync" path="/tmp/puppet20140114-5505-18bek2f-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Neutron-controler: ------------------- Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.524:276): avc: denied { name_connect } for pid=24062 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.599:277): avc: denied { read write } for pid=24069 comm="rsync" path="/tmp/puppet20140115-23789-38th53-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.600:278): avc: denied { name_connect } for pid=24069 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.189:279): avc: denied { read write } for pid=24079 comm="rsync" path="/tmp/puppet20140115-23789-11h1usl-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.190:280): avc: denied { name_connect } for pid=24079 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
I could not reproduce the AVC denials, it's possible that the selinux-policy package got fixed since this bug has been reported. Nevertheless, the openstack-selinux package should indeed be installed on nodes (unless they are running Fedora, where selinux-policy should be sufficient because it gets updated more frequently). Submitted a pull request upstream: https://github.com/redhat-openstack/astapor/pull/149
Verified with openstack-foreman-installer-1.0.6-2.el6ost.noarch openstack-selinux-0.1.3-2.el6ost.noarch is installed + There are no AVC's in /var/log/messages on the neutron-controller / neutron-networker.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2014-0517.html