Bug 1080481

Created attachment 878480 [details]
openstack-setup.log

Hi Amita, 

I wasn't able to replicat ethe bug, could you please also paste the logs from 10.65.201.125_horizon.pp.log in order to track it down properly.

Ok, I did a little digging and seems that the problem is on setsebool and at the moment we could not do anything because is not packstack related. What anyhow you could try to do is to test with a bigger timeout and see if it work properly.

There is no way to set timeout for setsebool. But unfortunately problem here is Puppet itself. I created bug for that some time ago: 

https://tickets.puppetlabs.com/browse/PUP-1948

The same symptoms are occurring on RHEL7RC.
Meanwhile this is a RHEL7 bug:
Here is the manifest excerpt from <IP>_horizon.pp generating the error:
--------------------
if ($::selinux != "false"){
    selboolean{'httpd_can_network_connect':
        value => on,
        persistent => true,
    }
}
-------------------

Debugging selboolean resource leads to setsebool -P command to fail:
---------
[root@p1-rh7 ~]# /usr/sbin/setsebool -P httpd_can_network_connect on
Killed
---------

As a matter of fact, any boolean flag setup with persistent option '-P' will fail.

This has been fixed in F20, tested using latest policycoreutils-2.2.5-3.fc20.x86_64.


Note, it doesn't matter if selinux is enforced or not (permissive).

(In reply to Gilles Dubreuil from comment #5)
> The same symptoms are occurring on RHEL7RC.
> Meanwhile this is a RHEL7 bug:
> Here is the manifest excerpt from <IP>_horizon.pp generating the error:
> --------------------
> if ($::selinux != "false"){
>     selboolean{'httpd_can_network_connect':
>         value => on,
>         persistent => true,
>     }
> }
> -------------------
> 
> Debugging selboolean resource leads to setsebool -P command to fail:
> ---------
> [root@p1-rh7 ~]# /usr/sbin/setsebool -P httpd_can_network_connect on
> Killed
> ---------
> 
> As a matter of fact, any boolean flag setup with persistent option '-P' will
> fail.
> 
> This has been fixed in F20, tested using latest
> policycoreutils-2.2.5-3.fc20.x86_64.

This is _not_ fixed in F20 - I have policycoreutils-2.2.5-4 - "setsebool -P httpd_can_network_connect on" will run OOM and get killed

Is there a workaround?  That is, can I use semodule to load a module that does the same thing as "setsebool -P httpd_can_network_connect on"?

> 
> 
> Note, it doesn't matter if selinux is enforced or not (permissive).

Correct.

semanage boolean --modify --on httpd_can_network_connect
has the same error - hits OOM

I got this bug today, on CentOS 7 with all updates installed, with Packstack installing OpenStack Juno. Is there a solution/workaround at this point?

I hit this error today. This is a fedora 20 install with packstack --allinone in a kvm vm. Host is f19 and guest is f20. The first run of packstack came up fine. I then changed the ip address of the nic and reran packstack. I then hit the error.

I bumped the vm ram to 4GB and then it worked. The vm was originally at 2GB. Top is showing 3.4 GB of memory in use in the working case.

Closing this as this is not a bug in packstack but in libsemanage. Workaround is to increase VM memory size or use newer libsemanage package.

*** This bug has been marked as a duplicate of bug 1098446 ***