Reassigning to openstack-selinux.
What version of openstack-selinux is installed? This rule was allowed a while back.
(In reply to Ryan Hallisey from comment #4) > What version of openstack-selinux is installed? This rule was allowed a > while back. openstack-selinux-0.6.23-1.el7ost.noarch
Perhaps we should blacklist openstack-selinux-0.6.23 when testing 7.0 - does it require 7.1 stuff ?
7.0.z + GA openstack-selinux => OK 7.0.z + A1 openstack-selinux => FAIL 7.1 + GA openstack-selinux => OK 7.1 + A1 openstack-selinux => OK
However, I can't explain why it failed. No rules related to keystone have changed in openstack-selinux.
This failed because 0.6.23 was built against selinux-policy-3.13.1-23.el7. This causes loading all openstack-selinux modules to quietly fail after RPM installation when coupled with the 7.0.z selinux-policy packages. Rebuilding the openstack-selinux package against selinux-policy-3.12.1-153.el7_0.13 resolves the issue. So, we can rebuild it, require the newer selinux-policy, or add a release note.
Each module has this error: libsepol.permission_copy_callback: Module os-glance depends on permission kill in class system, not satisfied (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). /usr/sbin/semodule: Failed!
There's a quiet dependency on newer selinux-policy causes openstack-selinux 0.6.23 to fail to install modules when paired with selinux-policy packages from Red Hat Enterprise Linux 7.0 or 7.0.z Keystone and other OpenStack services may receive 'AVC' denials, causing them to malfunction. Several workarounds exist: 1) Leave openstack-selinux at 0.6.18-2.el7ost until you are ready to update to Red Hat Enterprise Linux 7.1. At that time, a 'yum update' should resolve the issue. 2) Install the updated selinux-policy and selinux-policy-targeted packages from Red Hat Enterprise Linux 7.1 (version selinux-policy-3.13.1-23.el7 or later) and then update openstack-selinux to version 0.6.23-1.el7ost.
*** Bug 1199149 has been marked as a duplicate of this bug. ***
Subscription manager users can do: # yum downgrade openstack-selinux-0.6.18-2.el7ost
plz work with Tal Kammer in repdpcucing as he has reported this bug
Passed on the right version (VERIFIED): [root@RHEL7Server yum.repos.d]# rpm -qa openstack-selinux openstack-selinux-0.6.23-1.el7ost.noarch [root@RHEL7Server yum.repos.d]# semodule -l | grep 'os-' os-glance 0.1 os-keepalived 0.1 os-keystone 0.1 os-mysql 0.1 os-neutron 0.1 os-nova 0.1 os-ovs 0.1 os-rabbitmq 0.1 os-rsync 0.1 os-swift 0.1 [root@RHEL7Server yum.repos.d]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0789.html