Created attachment 1040411 [details] audit log - ovsdb Description of problem: When using the new native ovsdb implementation in neutron, user might get the following error: "ovsdb-server: ovs|04239|socket_util|ERR|6640:127.0.0.1: bind: Permission denied" Disabling selinux or setting it to permissive, make this error disappear. Steps to Reproduce: 1. Install openstack-neutron and run it (make sure ovsdb-server running) 2. run the following command: sudo ovs-vsctl set-manager ptcp:6640:127.0.0.1 Actual results: ovsdb-server: ovs|04239|socket_util|ERR|6640:127.0.0.1: bind: Permission denied Expected results: ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl set-manager ptcp:6640:127.0.0.1 Additional information: partial output from audit.log is attached
There is no need to install ovsdb-server to reproduce the issue, ovsdb-server would be enough. I will give some insight into why it should be allowed. Neutron added a new implementation to access ovsdb in Kilo (OSP7) called native. It does not use vsctl commands but instead use python bindings for OVS. Its connection URI to ovsdb can be controlled, but it should always be some tcp connection. And there is a config hook to control the URI. Most people will not configure it though, reusing the default, which is that "ptcp:6640:127.0.0.1": http://git.openstack.org/cgit/openstack/neutron/tree/neutron/agent/ovsdb/impl_idl.py#n31 I think we should allow that particular port to be opened by default SELinux wise.
The implication of this is that default native ovsdb driver settings are not usable with default selinux policies, so those interested in trying it out will either disable selinux or apply their own rules. Also, it means that we cannot execute functional tests for neutron out-of-the-box. It is applicable for OSP7+.
allow openvswitch_t unreserved_port_t:tcp_socket name_bind; This looks fine. If you got this AVC in enforcing mode, re run it in permissive so that you don't miss any AVCs.
Not sure it's a blocker though: native ovsdb driver is not enabled by default.
I've tested the new package (openstack-selinux-0.6.35-1.el7ost) and I can confirm that it works now =)
Verified on latest puddle form OpenStack/7.0-RHEL-7-Beta/2015-06-24.1/ on rhel7.1 openstack-selinux-0.6.35-1.el7ost Verified that ovsdb-server is running and ovs manager is set. No errors or AVCs are appeared
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2015:1548