Testing deployment of FreeIPA via Rolekit in Fedora 21 Beta TC4. To reproduce, install Beta TC4 from Server DVD and follow https://fedorahosted.org/rolekit/wiki/DomainController . In /var/log/audit/audit.log I see these denials: type=USER_AVC msg=audit(1413923153.653:461): pid=731 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.23 spid=3366 tpid=1876 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1413923178.251:462): pid=731 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.23 spid=3366 tpid=1876 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Getting the time stamps with ausearch, they coincide with this block in the journal. The first denial coincides with the last *successful* action (enabling of certmonger.service) which occurs before this block is shown, and the second denial occurs at the same time as this output block appears. Oct 21 13:26:18 ipa001.domain.local roled[1265]: 2014-10-21 13:26:18 ERROR: ERROR:dbus.proxies:Introspect error on :1.22:/org/fedorahosted/certmonger: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: ipa : DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 639, in run_script Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: return_value = main_function() Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/sbin/ipa-server-install", line 1095, in main Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: dm_password, subject_base=options.subject) Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 484, in configure_instance Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: self.start_creation(runtime=210) Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 367, in start_creation Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: method() Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1439, in configure_certmonger_renewal Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: path = iface.find_ca_by_nickname('dogtag-ipa-ca-renew-agent') Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 70, in __call__ Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: return self._proxy_method(*args, **keywords) Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: **keywords) Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: File "/usr/lib/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: message, timeout) Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: ipa : DEBUG The ipa-server-install command failed, exception: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: Unexpected error - see /var/log/ipaserver-install.log for details: Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. Oct 21 13:26:43 ipa001.domain.local roled[1265]: 2014-10-21 13:26:43 ERROR: <class 'rolekit.errors.RolekitError'>: COMMAND_FAILED: 256 As this causes FreeIPA deployment to fail, nominating as a Beta blocker bug per criterion: "Release-blocking roles and the supported role configuration interfaces must meet the core functional Role Definition Requirements to the extent that supported roles can be successfully started, stopped, brought to a working configuration, and queried." https://fedoraproject.org/wiki/Fedora_21_Beta_Release_Criteria#Roles
*** Bug 1155304 has been marked as a duplicate of this bug. ***
We need to get roled policy from another bug to F21.
Discussed at 2014-10-22 blocker review meeting: http://meetbot.fedoraproject.org/fedora-blocker-review/2014-10-22/f21-blocker-review.2014-10-22-16.03.log.txt . Accepted as a blocker per criterion cited in description.
selinux-policy-3.13.1-90.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/FEDORA-2014-13454/selinux-policy-3.13.1-90.fc21
Package selinux-policy-3.13.1-90.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-90.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-13454/selinux-policy-3.13.1-90.fc21 then log in and leave karma (feedback).
sgallagh reported success in verifying the fix with Beta RC1: marking as VERIFIED.
selinux-policy-3.13.1-90.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.