Bug 1053623
| Summary: | openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages). | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Omri Hochman <ohochman> |
| Component: | openstack-foreman-installer | Assignee: | Jiri Stransky <jstransk> |
| Status: | CLOSED ERRATA | QA Contact: | Omri Hochman <ohochman> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 4.0 | CC: | breeler, jguiditt, morazi, rhos-maint, yeylon |
| Target Milestone: | z4 | Keywords: | ZStream |
| Target Release: | 4.0 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-foreman-installer-1.0.6-1.el6ost | Doc Type: | Bug Fix |
| Doc Text: |
Cause: openstack-selinux package was not installed on nodes running OpenStack services.
Consequence: SELinux AVC denials.
Fix: install openstack-selinux package on nodes running OpenStack services.
Result: SELinux AVC denials no longer occur.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-05-29 20:30:32 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1049895 | ||
| Bug Blocks: | |||
I could not reproduce the AVC denials, it's possible that the selinux-policy package got fixed since this bug has been reported. Nevertheless, the openstack-selinux package should indeed be installed on nodes (unless they are running Fedora, where selinux-policy should be sufficient because it gets updated more frequently). Submitted a pull request upstream: https://github.com/redhat-openstack/astapor/pull/149 Verified with openstack-foreman-installer-1.0.6-2.el6ost.noarch openstack-selinux-0.1.3-2.el6ost.noarch is installed + There are no AVC's in /var/log/messages on the neutron-controller / neutron-networker. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2014-0517.html |
openstack-foreman-installer: openstack-selinux package is not installed on the foreman_clients (it cause: multiple AVCs in messages). Steps: ------ 1) Use foreman to install : - neutron-controller. - nova-network controller . 2) check foreman_clients /var/log/messages 3) check if there's opnestack-selinux installed on foreman_client machines ('rpm -qa | grep openstack-selinux') Results: ---------- - Installation of neutron-controller and nova-network-controller finished successfully . - multiple AVCs in Errors nder /var/log/messages - There's no openstack-selinux package installed on foreman_client machines. controller with nova-network: ----------------------------- Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.362:4): avc: denied { write } for pid=2510 comm="nc" name="testsock-da541e1a-b2f6-4c03-902f-cfb096abf1ab" dev=dm-0 ino=25296902 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.375:5): avc: denied { unmount } for pid=2511 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:6): avc: denied { execute } for pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.604:7): avc: denied { execute } for pid=2525 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.614:8): avc: denied { unmount } for pid=2526 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 11:47:40 puma01 kernel: type=1400 audit(1389692860.615:9): avc: denied { unmount } for pid=2527 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 12:07:08 puma01 dbus: avc: received policyload notice (seqno=2) Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.650:11): avc: denied { write } for pid=5613 comm="nc" name="testsock-5cb67415-69db-4ef2-a192-c26fcc8228c7" dev=dm-0 ino=25296918 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=sock_file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.663:12): avc: denied { unmount } for pid=5614 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:13): avc: denied { execute } for pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.914:14): avc: denied { execute } for pid=5629 comm="ip" name="arping" dev=dm-0 ino=20185180 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:netutils_exec_t:s0 tclass=file Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.924:15): avc: denied { unmount } for pid=5630 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:40 puma01 kernel: type=1400 audit(1389698260.925:16): avc: denied { unmount } for pid=5631 comm="ip" scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.386:17): avc: denied { read write } for pid=5860 comm="rsync" path="/tmp/puppet20140114-5505-1u4144a-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.388:18): avc: denied { name_connect } for pid=5860 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 14 13:17:52 puma01 kernel: type=1400 audit(1389698272.452:19): avc: denied { read write } for pid=5867 comm="rsync" path="/tmp/puppet20140114-5505-18bek2f-0" dev=dm-0 ino=25296919 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Neutron-controler: ------------------- Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.524:276): avc: denied { name_connect } for pid=24062 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.599:277): avc: denied { read write } for pid=24069 comm="rsync" path="/tmp/puppet20140115-23789-38th53-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 15 15:39:44 oh-havana-controller kernel: type=1400 audit(1389793184.600:278): avc: denied { name_connect } for pid=24069 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.189:279): avc: denied { read write } for pid=24079 comm="rsync" path="/tmp/puppet20140115-23789-11h1usl-0" dev=dm-0 ino=663441 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file Jan 15 15:39:46 oh-havana-controller kernel: type=1400 audit(1389793186.190:280): avc: denied { name_connect } for pid=24079 comm="rsync" dest=873 scontext=unconfined_u:system_r:rsync_t:s0 tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket