Bug 1114254
| Summary: | neutron fails to create a vip | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Amit Ugol <augol> | ||||||||
| Component: | openstack-selinux | Assignee: | Lon Hohberger <lhh> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Nir Magnezi <nmagnezi> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 5.0 (RHEL 7) | CC: | aberezin, lhh, mgrepl, nyechiel, oblaut, rhallise, yeylon | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | 5.0 (RHEL 7) | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | openstack-selinux-0.5.9-1.el7ost | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2014-07-08 15:16:00 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Amit Ugol
2014-06-29 09:01:18 UTC
*** Bug 1114257 has been marked as a duplicate of this bug. *** Its rather big so I just uploaded the formatter output. Do you want the entire thing ? We need to see raw AVC msgs. Created attachment 913500 [details] audit.log from cloned bz 1114257 setsebool -P daemons_enable_cluster_mode on
allow neutron_t haproxy_exec_t:file { read execute open execute_no_trans };
Will be added to the new build.
Ryan, I added to Fedora optional_policy(` domtrans_pattern(neutron_t, haproxy_exec_t, haproxy_t) ') Created attachment 913934 [details]
audit log with selinux-0.5.8-1
Created attachment 913935 [details]
audit2why
In the optional policy, if we do a domain transition, we need: manage_files_pattern(haproxy_t, neutron_var_lib_t, neutron_var_lib_t) manage_sock_files_pattern(haproxy_t, neutron_var_lib_t, neutron_var_lib_t) (In reply to Lon Hohberger from comment #13) > In the optional policy, if we do a domain transition, we need: > > manage_files_pattern(haproxy_t, neutron_var_lib_t, neutron_var_lib_t) > manage_sock_files_pattern(haproxy_t, neutron_var_lib_t, neutron_var_lib_t) Ok. Without a transition what we get haproxy running as neutron_t. Try to re-test and execute # ps -eZ |grep haproxy without the transition rules. Verified NVR: openstack-selinux-0.5.9-1.el7ost.noarch VIP tested ok with SELinux enforcing, Yet I still see some AVC denied messages. See Bug #1116755 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2014-0845.html |