Bug 1060809 - SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam from 'getattr' accesses on the file /run/rabbitmq/pid.
Summary: SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam from 'getattr' a...
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:59f059ae96425cd500d584848e2...
: 1060807 1060812 1060846 1060847 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-02-03 16:32 UTC by Daniel Ashton
Modified: 2015-06-30 01:34 UTC (History)
5 users (show)

Fixed In Version: selinux-policy-3.12.1-185.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-06-30 01:34:34 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
/var/log/audit/audit.log (4.68 MB, text/x-log)
2014-04-09 18:18 UTC, Daniel Ashton
no flags Details

Description Daniel Ashton 2014-02-03 16:32:28 UTC
Description of problem:
Attempted to start RabbitMQ service
SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam from 'getattr' accesses on the file /run/rabbitmq/pid.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/run/rabbitmq/pid default label should be rabbitmq_var_run_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /run/rabbitmq/pid

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that beam should be allowed getattr access on the pid file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep beam /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:rabbitmq_beam_t:s0
Target Context                system_u:object_r:initrc_var_run_t:s0
Target Objects                /run/rabbitmq/pid [ file ]
Source                        beam
Source Path                   /usr/lib64/erlang/erts-5.10.4/bin/beam
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           erlang-erts-R16B-03.1.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-119.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.12.9-301.fc20.x86_64 #1 SMP Wed
                              Jan 29 15:56:22 UTC 2014 x86_64 x86_64
Alert Count                   9
First Seen                    2014-01-28 10:34:26 EST
Last Seen                     2014-02-03 11:22:11 EST
Local ID                      c4b50f86-fcfa-4e12-af46-6568462ff92d

Raw Audit Messages
type=AVC msg=audit(1391444531.851:510): avc:  denied  { getattr } for  pid=2761 comm="beam.smp" path="/run/rabbitmq/pid" dev="tmpfs" ino=29233 scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file


type=SYSCALL msg=audit(1391444531.851:510): arch=x86_64 syscall=stat success=no exit=EACCES a0=7faf37341a80 a1=7faf3697dcb0 a2=7faf3697dcb0 a3=1 items=0 ppid=2722 pid=2761 auid=4294967295 uid=986 gid=983 euid=986 suid=986 fsuid=986 egid=983 sgid=983 fsgid=983 ses=4294967295 tty=(none) comm=beam.smp exe=/usr/lib64/erlang/erts-5.10.4/bin/beam.smp subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null)

Hash: beam,rabbitmq_beam_t,initrc_var_run_t,file,getattr

Additional info:
reporter:       libreport-2.1.11
hashmarkername: setroubleshoot
kernel:         3.12.9-301.fc20.x86_64
type:           libreport

Comment 1 Miroslav Grepl 2014-02-04 10:02:22 UTC
What does 

# ps -efZ |grep initrc_t

Comment 2 Miroslav Grepl 2014-02-04 10:02:44 UTC
*** Bug 1060807 has been marked as a duplicate of this bug. ***

Comment 3 Miroslav Grepl 2014-02-04 10:02:51 UTC
*** Bug 1060812 has been marked as a duplicate of this bug. ***

Comment 4 Miroslav Grepl 2014-02-04 10:02:58 UTC
*** Bug 1060846 has been marked as a duplicate of this bug. ***

Comment 5 Miroslav Grepl 2014-02-04 10:03:10 UTC
*** Bug 1060847 has been marked as a duplicate of this bug. ***

Comment 6 Daniel Ashton 2014-02-25 17:33:50 UTC
Description of problem:
Error occured when starting RabbitMQ service

Additional info:
reporter:       libreport-2.1.12
hashmarkername: setroubleshoot
kernel:         3.13.4-200.fc20.x86_64
type:           libreport

Comment 7 Daniel Ashton 2014-02-25 17:37:27 UTC
Description of problem:
Error occurred on starting RabbitMQ service

Additional info:
reporter:       libreport-2.1.12
hashmarkername: setroubleshoot
kernel:         3.13.4-200.fc20.x86_64
type:           libreport

Comment 8 Daniel Ashton 2014-02-25 18:39:29 UTC
Description of problem:
Starting RabbitMQ service

Additional info:
reporter:       libreport-2.1.12
hashmarkername: setroubleshoot
kernel:         3.13.4-200.fc20.x86_64
type:           libreport

Comment 9 Daniel Ashton 2014-02-27 16:55:09 UTC
Description of problem:
Starting RabbitMQ service

Additional info:
reporter:       libreport-2.1.12
hashmarkername: setroubleshoot
kernel:         3.13.5-200.fc20.x86_64
type:           libreport

Comment 10 Daniel Ashton 2014-03-18 13:07:34 UTC
Description of problem:
Starting RabbitMQ server

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 11 Daniel Ashton 2014-03-18 13:15:53 UTC
Description of problem:
Stopping RabbitMQ server

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 12 Daniel Ashton 2014-03-18 13:40:17 UTC
[root@localhost ~]# ps -efZ |grep initrc_t
system_u:system_r:initrc_t:s0   root       574     1  0 08:58 ?        00:00:01 /usr/sbin/VBoxService
system_u:system_r:initrc_t:s0-s0:c0.c1023 geoclue 1520 1  0 08:58 ?    00:00:00 /usr/libexec/geoclue -t 5
system_u:system_r:initrc_t:s0   root      6077     1  0 09:35 ?        00:00:00 /bin/sh /etc/rc.d/init.d/rabbitmq-server start
system_u:system_r:initrc_t:s0   root      6082  6077  0 09:35 ?        00:00:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
system_u:system_r:initrc_t:s0   root      6084  6082  0 09:35 ?        00:00:00 /bin/sh /usr/sbin/rabbitmq-server
system_u:system_r:initrc_t:s0   root      6102  6084  0 09:35 ?        00:00:00 su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 6555 6521  0 09:39 pts/2 00:00:00 grep --color=auto initrc_t
[root@localhost ~]#

Comment 13 Daniel Ashton 2014-03-20 14:27:14 UTC
Description of problem:
Starting RabbitMQ service

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 14 Lukas Vrabec 2014-04-02 11:28:12 UTC
Daniel, 

How do you started rabbitmq daemon???

Comment 15 Daniel Ashton 2014-04-02 15:22:20 UTC
To start the RabbitMQ daemon, I use 
  sudo /sbin/service rabbitmq-server start

I use a similar command to stop it.

Comment 16 Lukas Vrabec 2014-04-07 10:05:39 UTC
Hi, 

At first update your selinux-policy package

then:

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/run/rabbitmq/pid default label should be rabbitmq_var_run_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /run/rabbitmq/pid

and do: "# /sbin/restorecon -v /usr/lib/systemd/system/rabbitmq-server.service"

and restart rabbitmq-server service. 

Let me know if it working, please. 
Thank you!

Comment 17 Daniel Ashton 2014-04-07 19:23:56 UTC
Description of problem:
Starting RabbitMQ Server

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.8-200.fc20.x86_64
type:           libreport

Comment 18 Daniel Ashton 2014-04-07 19:30:08 UTC
Thanks Lukas. The paths you mention (/run/rabbitmq/pid and /usr/lib/systemd/system/rabbitmq-server.service) don't exist on my system. Perhaps this is because I was using the (then) current RabbitMQ 3.2.3-1 from their website instead of the older version from the Fedora repos.  This is the page that documents the current release of RabbitMQ, including installing, starting, stopping and so forth: http://www.rabbitmq.com/install-rpm.html

I just uninstalled 3.2.3-1 and installed the new 3.3.0-1, and I'm getting the same three AVC Denials when starting the service. One is on bug 1060805, and cannot be reported by the automatic tool because that bug shows as closed. The other two AVC Denials are on this bug (1060809) and either add to the comment chain here or are identified by the tool as duplicate comments and not submitted.

Even with the new version installed, there is no /run/rabbitmq/ directory and no files at /usr/lib/systemd/system/rabbitmq* .

I'd love to help you nail this bug. Let me know what further info I can provide for you.

Comment 19 Lukas Vrabec 2014-04-09 14:20:54 UTC
Hi, 

Can you paste here all your AVCs in /var/log/audit.log. 
I would like to see them all.

Comment 20 Daniel Ashton 2014-04-09 18:06:32 UTC
I'll submit /var/log/audit/audit.log (note the difference from the path you requested is this OK?) as an attachment to this bug, since it's far too large to paste here.

Comment 21 Daniel Ashton 2014-04-09 18:18:05 UTC
Created attachment 884613 [details]
/var/log/audit/audit.log

Current version of /var/log/audit/audit.log, as requested for bug 1060809. Three earlier files are also available, but I'm guessing there's a huge amount of repetition and not much of value in them.

Comment 22 Lukas Vrabec 2014-04-10 09:08:26 UTC
Ou, yes I gave you wrong path, but you find it! Sorry.

Thank you for attachment.

Comment 23 Lukas Vrabec 2014-04-10 10:33:00 UTC
Daniel,

I fixed your issue connecting with rabbitmq_var_log_t.  

commit e51f7496cfb514298ff8a03551b69e2e5318d072
Author: Lukas Vrabec <lvrabec>
Date:   Thu Apr 10 12:18:12 2014 +0200

    Allow rabbitmq_epmd to manage rabbit_var_log_t files

Second AVC related to initrc_var_run_t. 

I cannot reproduce it. Everything is OK on my F20 system.

See:
# systemctl status rabbitmq-server
rabbitmq-server.service - RabbitMQ broker
   Loaded: loaded (/usr/lib/systemd/system/rabbitmq-server.service; disabled)
   Active: active (running) since Thu 2014-04-10 06:07:39 EDT; 20min ago
  Process: 16505 ExecStartPost=/usr/lib/rabbitmq/bin/rabbitmqctl wait /var/run/rabbitmq/pid (code=exited, status=0/SUCCESS)
 Main PID: 16504 (beam)
   CGroup: /system.slice/rabbitmq-server.service
           ├─16504 /usr/lib64/erlang/erts-5.10.4/bin/beam -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.1.5/sbin/../ebin -noshell -noinp...
           ├─16612 inet_gethost 4
           └─16613 inet_gethost 4


# ps -efZ | grep rabbit
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 16504 1  0 06:06 ?       00:00:03 /usr/lib64/erlang/erts-5.10.4/bin/beam -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.1.5/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@Fedora20-virt -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.1.5/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@Fedora20-virt-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@Fedora20-virt"
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 16612 16504  0 06:07 ?   00:00:00 inet_gethost 4
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 16613 16612  0 06:07 ?   00:00:00 inet_gethost 4

Tested with actual rabbitmq-server packages in fedora repo.

So could you re-test it?

Comment 24 Daniel Ashton 2014-04-10 13:18:26 UTC
Description of problem:
Starting RabbitMQ server

Additional info:
reporter:       libreport-2.2.1
hashmarkername: setroubleshoot
kernel:         3.13.9-200.fc20.x86_64
type:           libreport

Comment 25 Daniel Ashton 2014-04-10 14:32:03 UTC
Thanks Lukas. I'm still getting the same set of errors. If I `setenforce 0`, of course, nothing is logged. Further, when I start the RabbitMQ server, if SELinux is enforcing, the start reports that it failed, but it actually starts up anyway.

It's very possible, even likely, that you cannot reproduce this set of errors with the Fedora repo version of RabbitMQ, because it is so far behind the current release. I'm grateful for all the fixes you have made so far.

I would be happy to upload my new audit.log if you feel there would be any further enlightenment to be found there.

[jdashton@localhost ~]$ sudo /sbin/service rabbitmq-server start
Starting rabbitmq-server (via systemctl):  Job for rabbitmq-server.service failed. See 'systemctl status rabbitmq-server.service' and 'journalctl -xn' for details.
                                                           [FAILED]

[jdashton@localhost ~]$ sudo systemctl status rabbitmq-server
rabbitmq-server.service - LSB: Enable AMQP service provided by RabbitMQ broker
   Loaded: loaded (/etc/rc.d/init.d/rabbitmq-server)
   Active: failed (Result: exit-code) since Thu 2014-04-10 09:15:06 EDT; 20s ago
  Process: 8092 ExecStop=/etc/rc.d/init.d/rabbitmq-server stop (code=exited, status=2)
  Process: 8414 ExecStart=/etc/rc.d/init.d/rabbitmq-server start (code=exited, status=1/FAILURE)

Apr 10 09:15:05 localhost.localdomain systemd[1]: Starting LSB: Enable AMQP service provided by RabbitMQ broker...
Apr 10 09:15:05 localhost.localdomain su[8424]: (to rabbitmq) root on none
Apr 10 09:15:06 localhost.localdomain su[8520]: (to rabbitmq) root on none
Apr 10 09:15:06 localhost.localdomain su[8523]: (to rabbitmq) root on none
Apr 10 09:15:06 localhost.localdomain rabbitmq-server[8414]: Starting rabbitmq-server: FAILED - check /var/log/rabbitmq/startup_{log, _err}
Apr 10 09:15:06 localhost.localdomain rabbitmq-server[8414]: rabbitmq-server.
Apr 10 09:15:06 localhost.localdomain systemd[1]: rabbitmq-server.service: control process exited, code=exited status=1
Apr 10 09:15:06 localhost.localdomain systemd[1]: Failed to start LSB: Enable AMQP service provided by RabbitMQ broker.
Apr 10 09:15:06 localhost.localdomain systemd[1]: Unit rabbitmq-server.service entered failed state.

[jdashton@localhost ~]$ ps -efZ | grep rabbit
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 jdashton 2013 1  0 07:42 ? 00:00:00 /usr/bin/python /usr/lib/python2.7/site-packages/rabbitvcs/services/checkerservice.pyc
system_u:system_r:init_t:s0     rabbitmq  2245     1  0 07:50 ?        00:00:00 /usr/lib/systemd/systemd --user
system_u:system_r:init_t:s0     rabbitmq  2248  2245  0 07:50 ?        00:00:00 (sd-pam)
system_u:system_r:rabbitmq_epmd_t:s0 rabbitmq 2264 1  0 07:50 ?        00:00:00 /usr/lib64/erlang/erts-5.10.4/bin/epmd -daemon
system_u:system_r:initrc_t:s0   root      8498     1  0 09:15 ?        00:00:00 /bin/sh /etc/rc.d/init.d/rabbitmq-server start
system_u:system_r:initrc_t:s0   root      8500  8498  0 09:15 ?        00:00:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
system_u:system_r:initrc_t:s0   root      8503  8500  0 09:15 ?        00:00:00 /bin/sh /usr/sbin/rabbitmq-server
system_u:system_r:initrc_t:s0   root      8520  8503  0 09:15 ?        00:00:00 su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 8526 8520 16 09:15 ?     00:00:11 /usr/lib64/erlang/erts-5.10.4/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.3.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@localhost -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.3.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@localhost-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@localhost" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 8803 8526  0 09:15 ?     00:00:00 inet_gethost 4
system_u:system_r:rabbitmq_beam_t:s0 rabbitmq 8804 8803  0 09:15 ?     00:00:00 inet_gethost 4
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 jdashton 8846 4389  0 09:16 pts/1 00:00:00 grep --color=auto rabbit

[jdashton@localhost ~]$ sudo rabbitmqctl status
Status of node rabbit@localhost ...
[{pid,8526},
 {running_applications,
     [{rabbitmq_federation_management,"RabbitMQ Federation Management",
          "3.3.0"},
      {rabbitmq_management,"RabbitMQ Management Console","3.3.0"},
      {rabbitmq_web_dispatch,"RabbitMQ Web Dispatcher","3.3.0"},
      {webmachine,"webmachine","1.10.3-rmq3.3.0-gite9359c7"},
      {mochiweb,"MochiMedia Web Server","2.4.2"},
      {rabbitmq_federation,"RabbitMQ Federation","3.3.0"},
      {rabbitmq_management_agent,"RabbitMQ Management Agent","3.3.0"},
      {rabbit,"RabbitMQ","3.3.0"},
      {os_mon,"CPO  CXC 138 46","2.2.14"},
      {ssl,"Erlang/OTP SSL application","5.3.2"},
      {public_key,"Public key infrastructure","0.21"},
      {crypto,"CRYPTO version 2","3.2"},
      {inets,"INETS  CXC 138 49","5.9.7"},
      {mnesia,"MNESIA  CXC 138 12","4.11"},
      {compiler,"ERTS  CXC 138 10","4.9.4"},
      {amqp_client,"RabbitMQ AMQP Client","3.3.0"},
      {xmerl,"XML parser","1.3.5"},
      {syntax_tools,"Syntax tools","1.6.12"},
      {asn1,"The Erlang ASN1 compiler version 2.0.4","2.0.4"},
      {sasl,"SASL  CXC 138 11","2.3.4"},
      {stdlib,"ERTS  CXC 138 10","1.19.4"},
      {kernel,"ERTS  CXC 138 10","2.16.4"}]},
 {os,{unix,linux}},
 {erlang_version,
     "Erlang R16B03 (erts-5.10.4) [source] [64-bit] [smp:2:2] [async-threads:30] [hipe] [kernel-poll:true]\n"},
 {memory,
     [{total,47673568},
      {connection_procs,19528},
      {queue_procs,104216},
      {plugins,408216},
      {other_proc,14244408},
      {mnesia,120008},
      {mgmt_db,103904},
      {msg_index,31792},
      {other_ets,1327344},
      {binary,24296},
      {code,25578414},
      {atom,891825},
      {other_system,4819617}]},
 {alarms,[]},
 {listeners,[{clustering,25672,"::"},{amqp,5672,"::"}]},
 {vm_memory_high_watermark,0.4},
 {vm_memory_limit,3349654732},
 {disk_free_limit,50000000},
 {disk_free,67818647552},
 {file_descriptors,
     [{total_limit,924},{total_used,10},{sockets_limit,829},{sockets_used,1}]},
 {processes,[{limit,1048576},{used,208}]},
 {run_queue,0},
 {uptime,93}]
...done.

Comment 26 Lukas Vrabec 2014-04-14 13:22:25 UTC
Daniel, please run: "# chcon -t rabbitmq_beam_exec_t /usr/sbin/rabbitmq-server" 
and then: "# systemctl restart rabbitmq-server" in enforcing mode?

Comment 27 Daniel Ashton 2014-04-14 14:41:21 UTC
Doing the above (chcon and then restarting rabbitmq-server) seems to make the situation better, in that no SELinux AVC alerts popped-up during the restart of rabbitmq-server.

On the other hand, when I run 'sudo /sbin/service rabbitmq-server start', the starting process never completes. OK, not never, it just completed after 5 minutes. Running 'systemctl status rabbitmq-server.service' gave me this:

rabbitmq-server.service - LSB: Enable AMQP service provided by RabbitMQ broker
   Loaded: loaded (/etc/rc.d/init.d/rabbitmq-server)
   Active: failed (Result: timeout) since Mon 2014-04-14 10:38:04 EDT; 24s ago
  Process: 2526 ExecStart=/etc/rc.d/init.d/rabbitmq-server start (code=killed, signal=TERM)

Apr 14 10:33:04 localhost.localdomain su[2536]: (to rabbitmq) root on none
Apr 14 10:33:05 localhost.localdomain su[2670]: (to rabbitmq) root on none
Apr 14 10:38:04 localhost.localdomain systemd[1]: rabbitmq-server.service operation timed out. Terminating.
Apr 14 10:38:04 localhost.localdomain rabbitmq-server[2526]: Starting rabbitmq-server:
Apr 14 10:38:04 localhost.localdomain systemd[1]: Failed to start LSB: Enable AMQP service provided by RabbitMQ broker.
Apr 14 10:38:04 localhost.localdomain systemd[1]: Unit rabbitmq-server.service entered failed state.

And running 'journalctl -xn' gave this info:

-- Logs begin at Thu 2014-01-23 20:12:16 EST, end at Mon 2014-04-14 10:38:04 EDT. --
Apr 14 10:37:30 localhost.localdomain NetworkManager[622]: bound to 10.0.2.4 -- renewal in 466 seconds.
Apr 14 10:37:30 localhost.localdomain dbus-daemon[493]: dbus[493]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-d
Apr 14 10:37:30 localhost.localdomain systemd[1]: Starting Network Manager Script Dispatcher Service...
-- Subject: Unit NetworkManager-dispatcher.service has begun with start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit NetworkManager-dispatcher.service has begun starting up.
Apr 14 10:37:30 localhost.localdomain dbus-daemon[493]: dbus[493]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Apr 14 10:37:30 localhost.localdomain dbus[493]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Apr 14 10:37:30 localhost.localdomain systemd[1]: Started Network Manager Script Dispatcher Service.
-- Subject: Unit NetworkManager-dispatcher.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit NetworkManager-dispatcher.service has finished starting up.
-- 
-- The start-up result is done.
Apr 14 10:38:04 localhost.localdomain systemd[1]: rabbitmq-server.service operation timed out. Terminating.
Apr 14 10:38:04 localhost.localdomain rabbitmq-server[2526]: Starting rabbitmq-server:
Apr 14 10:38:04 localhost.localdomain systemd[1]: Failed to start LSB: Enable AMQP service provided by RabbitMQ broker.
-- Subject: Unit rabbitmq-server.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit rabbitmq-server.service has failed.
-- 
-- The result is failed.
Apr 14 10:38:04 localhost.localdomain systemd[1]: Unit rabbitmq-server.service entered failed state.



Also, there was still an AVC alert related to epmd that seems to have occurred during system start-up (related to 1060805, which cannot accept reports as it is closed), and an AVC Alert attributed to bash, which I just submitted as a new bug.

Comment 28 Lukas Vrabec 2014-09-11 15:38:36 UTC
Hi, 
This is fixed in version selinux-policy-3.12.1-185.fc20

Thank you for testing.

Comment 29 Fedora Update System 2014-09-23 08:29:20 UTC
selinux-policy-3.12.1-186.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-186.fc20

Comment 30 Fedora Update System 2014-09-25 10:44:46 UTC
Package selinux-policy-3.12.1-186.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-186.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-11479/selinux-policy-3.12.1-186.fc20
then log in and leave karma (feedback).

Comment 31 Fedora Update System 2014-09-25 16:57:34 UTC
selinux-policy-3.12.1-187.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-187.fc20

Comment 32 Fedora Update System 2014-09-30 08:36:26 UTC
selinux-policy-3.12.1-188.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-188.fc20

Comment 33 Fedora End Of Life 2015-05-29 10:47:35 UTC
This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 34 Fedora End Of Life 2015-06-30 01:34:34 UTC
Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.