Bug 1151647

The nova_conductor_t type is defined in selinux-policy >= 3.13. Could you remove that type from tripleo-selinux-keepalived.te ?

How does the custom policy look?

After removing nova_conductor_t, the policy still failed to install. I had to remove the following for the custom policy to install.

nova_conductor_t
cinder_scheduler_t 
cinder_volume_t
cinder_api_t

Switching this from Red Hat Enterprise Linux selinux-policy to Red Hat Openstack openstack-selinux because nova_conductor_t is defined in the RHEL 7.1 selinux-policy, and we need this fixed for RHOS 5 / RHEL 7.0.

Created attachment 949258 [details]
updated custom policy

I recommend simply doing:

optional_policy(`
    unconfined_domain(keepalived_t);
')

whoops...

module tripleo-selinux-keepalived 1.0;

require {
    type keepalived_t;
}

optional_policy(`
        unconfined_domain(keepalived_t)
')

Last one, I promise:

policy_module(tripleo-selinux-keepalived, 1.0.0)

gen_require(`
        type swift_t;
')

optional_policy(`
        unconfined_domain(keepalived_t)
')

This worked for me:

domain_read_all_domains_state(keepalived_t)
allow keepalived_t haproxy_t:process signull;
allow keepalived_t self:capability kill;

#============= rabbitmq_beam_t ==============
allow rabbitmq_beam_t rabbitmq_var_lib_t:lnk_file read;

#============= rhsmcertd_t ==============
allow rhsmcertd_t rpm_var_lib_t:dir { write add_name };
allow rhsmcertd_t rpm_var_lib_t:file create;

That's more ideal than unconfined_domain and should avoid the type issue.

Though, the last two lines seem ... out of place/context?

[root@rhel7 ~]# seinfo -t | grep nova_

Does not show nova_provider_t even with RHEL 7.1 and current openstack-selinux.

The tripleo component was never shipped against RHEL OSP 5, and this is resolved on RHEL OSP 7.