Bug 1176830 – RHOS5 with RHEL7.1 : selinux denied on neutron-ns-meta

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1176830 - RHOS5 with RHEL7.1 : selinux denied on neutron-ns-meta

Summary:	RHOS5 with RHEL7.1 : selinux denied on neutron-ns-meta

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-selinux (Show other bugs)
Sub Component:
Version:	5.0 (RHEL 7)
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	z5
Target Release:	5.0 (RHEL 7)
Assigned To:	Ryan Hallisey
QA Contact:	yeylon@redhat.com
Docs Contact:

URL:
Whiteboard:
Keywords:	OtherQA, Triaged, ZStream

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-12-23 07:35 EST by bkopilov
Modified:	2016-04-18 02:49 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	openstack-selinux-0.6.37-1.el7ost
Doc Type:	Bug Fix
Doc Text:	Prior to this update, SELinux was preventing neutron from using the file system. As a consequence, neutron failed to run. Now, an appropriate rule has been added to SELinux, which allows neutron to run with SELinux in enforcing mode.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-09-10 07:46:06 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2015:1762	normal	SHIPPED_LIVE	Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory	2015-09-10 11:45:31 EDT

Groups: None (edit)

Description bkopilov 2014-12-23 07:35:01 EST

Description of problem:
Running rhel7.1 with rhos5 .

From audit.log :

11:21:30 10.35.182.167|check_errors_post_test<<<--|14505:type=AVC msg=audit(1419326478.236:14309): avc:  denied  { getattr } for  pid=32013 comm="neutron-ns-meta" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem


Attaching full log file from automation run ,

Thanks , 
Benny

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 5 Lon Hohberger 2015-08-27 13:22:51 EDT

[root@rhel7 ~]# audit2why -i tmp.in
type=AVC msg=audit(1419326478.236:14309): avc:  denied  { getattr } for  pid=32013 comm="neutron-ns-meta" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem

	Was caused by:
		Unknown - would be allowed by active policy
		Possible mismatch between this policy and the one under which the audit message was generated.

		Possible mismatch between current in-memory boolean settings vs. permanent ones.

[root@rhel7 ~]# rpm -q openstack-selinux
openstack-selinux-0.6.37-1.el7ost.noarch

Comment 6 Lon Hohberger 2015-08-27 13:23:27 EDT

IOW, the current policies address this on RHEL 7.1

Comment 7 Lon Hohberger 2015-08-27 13:24:33 EDT

Note: 0.6.37 has not been released on RHEL OSP 5 for RHEL 7.

Comment 10 Lon Hohberger 2015-09-02 15:40:10 EDT

Verified re: comment #5

Comment 12 errata-xmlrpc 2015-09-10 07:46:06 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1762.html

Note You need to log in before you can comment on or make changes to this bug.