Created attachment 945189 [details] audit.log from control node Description of problem: Swift services are being denied search on /var/lib/swift/.local. The policy doesn't define a default file context for /var/lib/swift so it is currently labeled as drwxr-xr-x. swift root unconfined_u:object_r:var_lib_t:s0 swift Version-Release number of selected component (if applicable): openstack-swift-2.2.0.rc1.2-g7528f2b.fc20.noarch openstack-swift-account-2.2.0.rc1.2-g7528f2b.fc20.noarch openstack-swift-container-2.2.0.rc1.2-g7528f2b.fc20.noarch openstack-swift-object-2.2.0.rc1.2-g7528f2b.fc20.noarch openstack-swift-plugin-swift3-1.7-3.fc20.noarch openstack-swift-proxy-2.2.0.rc1.2-g7528f2b.fc20.noarch selinux-policy-3.12.1-183.fc20.noarch selinux-policy-targeted-3.12.1-183.fc20.noarch How reproducible: always Steps to Reproduce: 1. Deploy the overcloud using instack-undercloud. 2. Run instack-test-overcloud. Actual results: swift denials logged Expected results: no swift denials logged Additional info: type=AVC msg=audit(1412792989.946:750): avc: denied { search } for pid=6226 comm="swift-container" name=".local" dev="sda1" ino=1016668 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:init_var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1412792990.133:752): avc: denied { search } for pid=6236 comm="swift-object-se" name=".local" dev="sda1" ino=1016668 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:init_var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1412792990.329:754): avc: denied { search } for pid=6241 comm="swift-object-au" name=".local" dev="sda1" ino=1016668 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:init_var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1412792990.526:756): avc: denied { search } for pid=6251 comm="swift-object-re" name=".local" dev="sda1" ino=1016668 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:init_var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1412792990.706:758): avc: denied { search } for pid=6261 comm="swift-object-up" name=".local" dev="sda1" ino=1016668 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:init_var_lib_t:s0 tclass=dir permissive=0
commit 0c0a0540fd09149697c095b0647c823908e62ac4 Author: Miroslav Grepl <mgrepl> Date: Mon Oct 13 14:10:44 2014 +0200 Add support for /var/lib/swiftdirectory.
selinux-policy-3.12.1-192.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-192.fc20
Package selinux-policy-3.12.1-192.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-192.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-13495/selinux-policy-3.12.1-192.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-192.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.