Red Hat Bugzilla – Bug 1159330
RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for httpd
Last modified: 2015-03-05 05:14:17 EST
Description of problem: On RHEL7.1, it appears that the setsebool from ipa-server-install --uninstall is incorrectly setting httpd booleans to None instead of off. On RHEL7.1, it tries to set the following: 2014-10-31T14:14:48Z DEBUG args='/usr/sbin/setsebool' '-P' 'httpd_can_network_connect=None' 'httpd_manage_ipa=None' On RHEL7.0, it sets them like this: 2014-10-31T14:39:57Z DEBUG args=/usr/sbin/setsebool -P httpd_can_network_connect off ... 2014-10-31T14:40:07Z DEBUG args=/usr/sbin/setsebool -P httpd_manage_ipa off This is failing to change settings and throwing a warning: [root@rhel7-1 yum.local.d]# ipa-server-install --uninstall -U WARNING: Failed to connect to Directory Server to find information about replication agreements. Uninstallation will continue despite the possible existing replication agreements. Shutting down all IPA services Removing IPA client configuration WARNING: Could not set SELinux booleans: httpd_can_network_connect=None httpd_manage_ipa=None Version-Release number of selected component (if applicable): ipa-server-4.1.0-3.el7.x86_64 How reproducible: always. Steps to Reproduce: 1. ipa-server-install # install server per normal 2. ipa-server-install --uninstall -U Actual results: WARNING: Could not set SELinux booleans: httpd_can_network_connect=None httpd_manage_ipa=None Expected results: booleans set to off and not errors/warnings. Additional info: /var/log/ipaserver-uninstall.log: 2014-10-31T14:14:48Z DEBUG Starting external process 2014-10-31T14:14:48Z DEBUG args='/usr/sbin/getsebool' 'httpd_can_network_connect' 2014-10-31T14:14:48Z DEBUG Process finished, return code=0 2014-10-31T14:14:48Z DEBUG stdout=httpd_can_network_connect --> off 2014-10-31T14:14:48Z DEBUG stderr= 2014-10-31T14:14:48Z DEBUG Starting external process 2014-10-31T14:14:48Z DEBUG args='/usr/sbin/getsebool' 'httpd_manage_ipa' 2014-10-31T14:14:48Z DEBUG Process finished, return code=0 2014-10-31T14:14:48Z DEBUG stdout=httpd_manage_ipa --> off 2014-10-31T14:14:48Z DEBUG stderr= 2014-10-31T14:14:48Z DEBUG Starting external process 2014-10-31T14:14:48Z DEBUG args='/usr/sbin/setsebool' '-P' 'httpd_can_network_connect=None' 'httpd_manage_ipa=None' 2014-10-31T14:14:48Z DEBUG Process finished, return code=255 2014-10-31T14:14:48Z DEBUG stdout= 2014-10-31T14:14:48Z DEBUG stderr=setsebool: illegal value None for boolean httpd_can_network_connect 2014-10-31T14:14:48Z DEBUG WARNING: Could not set SELinux booleans: httpd_can_network_connect=None httpd_manage_ipa=None
ipa-server-install --uninstall certainly should not use 'None' as setsebool's option value. But in your case, the `ipa-server-install --uninstall -U` output look as if ipa-server was previously uninstalled. `ipa-server-install` then incorrectly handles saved state(None) and does the incorrect call.
to confirm comment 2: [root@host ~]$ getsebool -a | grep -E 'httpd_can_network_connect|httpd_manage_ipa' httpd_can_network_connect --> on httpd_can_network_connect_cobbler --> off httpd_can_network_connect_db --> off httpd_manage_ipa --> on [root@host ~]$ ipa-server-install --uninstall -U Shutting down all IPA services Removing IPA client configuration Unconfiguring ntpd Unconfiguring CA Unconfiguring named Unconfiguring web server Unconfiguring krb5kdc Unconfiguring kadmin Unconfiguring directory server Unconfiguring ipa_memcached Unconfiguring ipa-otpd [root@host ~]$ getsebool -a | grep -E 'httpd_can_network_connect|httpd_manage_ipa' httpd_can_network_connect --> off httpd_can_network_connect_cobbler --> off httpd_can_network_connect_db --> off httpd_manage_ipa --> off [root@host ~]$ ipa-server-install --uninstall -U WARNING: Failed to connect to Directory Server to find information about replication agreements. Uninstallation will continue despite the possible existing replication agreements. Shutting down all IPA services Removing IPA client configuration WARNING: Could not set SELinux booleans: httpd_can_network_connect=None httpd_manage_ipa=None
Upstream ticket: https://fedorahosted.org/freeipa/ticket/4678
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/a14ce85357419f41f0994625d29d3f1af7a53d4c ipa-4-1: https://fedorahosted.org/freeipa/changeset/1d7407c06caa06119635910d34213167d97125a0
Verified. Version :: ipa-server-4.1.0-7.el7.x86_64 Results :: [root@vm3 log]# getsebool httpd_can_network_connect httpd_can_network_connect --> on [root@vm3 log]# getsebool httpd_manage_ipa httpd_manage_ipa --> on [root@vm3 log]# ipa-server-install --uninstall -U Shutting down all IPA services Removing IPA client configuration Unconfiguring ntpd Unconfiguring CA Unconfiguring named Unconfiguring web server Unconfiguring krb5kdc Unconfiguring kadmin Unconfiguring directory server Unconfiguring ipa_memcached Unconfiguring ipa-otpd [root@vm3 log]# ipa-server-install --uninstall -U WARNING: Failed to connect to Directory Server to find information about replication agreements. Uninstallation will continue despite the possible existing replication agreements. Shutting down all IPA services Removing IPA client configuration [root@vm3 log]# ipa-server-install --uninstall -U WARNING: Failed to connect to Directory Server to find information about replication agreements. Uninstallation will continue despite the possible existing replication agreements. Shutting down all IPA services Removing IPA client configuration [root@vm3 log]# getsebool httpd_can_network_connect httpd_can_network_connect --> off [root@vm3 log]# getsebool httpd_manage_ipa httpd_manage_ipa --> off
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html