1252675 – neutron-server cannot connect to port 5000 due to SELinux

RDO tickets are now tracked in Jira https://issues.redhat.com/projects/RDO/issues/

Bug 1252675 - neutron-server cannot connect to port 5000 due to SELinux

Summary: neutron-server cannot connect to port 5000 due to SELinux

Keywords:
Status:	CLOSED EOL
Alias:	None
Product:	RDO
Classification:	Community
Component:	openstack-selinux
Sub Component:
Version:	Kilo
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	---
Target Release:	Kilo
Assignee:	Lon Hohberger
QA Contact:	Ofer Blaut
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2015-08-12 05:00 UTC by Joe Doss
Modified:	2016-05-19 15:40 UTC (History)
CC List:	1 user (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-05-19 15:40:58 UTC
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Description Joe Doss 2015-08-12 05:00:08 UTC

Description of problem:

Starting a new instances on a fresh packstack --allinone fails to start instances.

Version-Release number of selected component (if applicable):

openstack-neutron-2015.1.0-1.fc23.noarch
openstack-packstack-2015.1-0.10.dev1608.g6447ff7.fc23.noarch


How reproducible:

Always.

Steps to Reproduce:
1. Packstack --allinone on Fedora 22 Server with setenforce 1 and Open vSwitch
2. Launch a new instance

Actual results:

/var/log/nova/nova-compute.log shows the following:

2015-08-11 23:14:02.500 11827 WARNING nova.virt.libvirt.driver [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] Timeout waiting for vif plugging callback for instance 8ed79adb-2b3f-4622-8209-d722145713ac
2015-08-11 23:14:02.716 11827 INFO nova.compute.manager [req-d826bd2b-8031-4323-8997-b507dd1fc29d - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] VM Stopped (Lifecycle Event)
2015-08-11 23:14:02.860 11827 INFO nova.compute.manager [req-d826bd2b-8031-4323-8997-b507dd1fc29d - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] During sync_power_state the instance has a pending task (spawning). Skip.
2015-08-11 23:14:03.445 11827 INFO nova.virt.libvirt.driver [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Deleting instance files /var/lib/nova/instances/8ed79adb-2b3f-4622-8209-d722145713ac_del
2015-08-11 23:14:03.446 11827 INFO nova.virt.libvirt.driver [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Deletion of /var/lib/nova/instances/8ed79adb-2b3f-4622-8209-d722145713ac_del complete
2015-08-11 23:14:03.644 11827 ERROR nova.compute.manager [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Instance failed to spawn
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Traceback (most recent call last):
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2442, in _build_resources
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     yield resources
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2314, in _build_and_run_instance
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     block_device_info=block_device_info)
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 2354, in spawn
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     block_device_info=block_device_info)
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 4412, in _create_domain_and_network
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     raise exception.VirtualInterfaceCreateException()
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] VirtualInterfaceCreateException: Virtual Interface creation failed
2015-08-11 23:14:03.644 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] 
2015-08-11 23:14:03.651 11827 INFO nova.compute.manager [req-2a847954-b7e6-4a4b-b2fd-487b1f554e79 f8f0e88f87eb4d7fa3fe19db6e0fc986 42202a023e7f4bababbcbaf3a2b609a3 - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Terminating instance
2015-08-11 23:14:03.654 11827 INFO nova.virt.libvirt.driver [-] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] During wait destroy, instance disappeared.
2015-08-11 23:14:03.943 11827 INFO nova.virt.libvirt.driver [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Deletion of /var/lib/nova/instances/8ed79adb-2b3f-4622-8209-d722145713ac_del complete
2015-08-11 23:14:04.211 11827 INFO nova.scheduler.client.report [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] Compute_service record updated for ('sts9.inf7.net', 'sts9.inf7.net')
2015-08-11 23:14:04.213 11827 ERROR nova.compute.manager [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Failed to allocate network(s)
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Traceback (most recent call last):
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2314, in _build_and_run_instance
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     block_device_info=block_device_info)
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 2354, in spawn
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     block_device_info=block_device_info)
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 4412, in _create_domain_and_network
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     raise exception.VirtualInterfaceCreateException()
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] VirtualInterfaceCreateException: Virtual Interface creation failed
2015-08-11 23:14:04.213 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] 
2015-08-11 23:14:04.214 11827 ERROR nova.compute.manager [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Build of instance 8ed79adb-2b3f-4622-8209-d722145713ac aborted: Failed to allocate the network(s), not rescheduling.
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] Traceback (most recent call last):
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2219, in _do_build_and_run_instance
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     filter_properties)
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2349, in _build_and_run_instance
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac]     reason=msg)
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] BuildAbortException: Build of instance 8ed79adb-2b3f-4622-8209-d722145713ac aborted: Failed to allocate the network(s), not rescheduling.
2015-08-11 23:14:04.214 11827 TRACE nova.compute.manager [instance: 8ed79adb-2b3f-4622-8209-d722145713ac] 
2015-08-11 23:14:04.344 11827 ERROR nova.network.neutronv2.api [req-0fe6dd08-9bd9-42fb-ba17-db8256b40729 - - - - -] Unable to clear device ID for port 'None'
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api Traceback (most recent call last):
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/nova/network/neutronv2/api.py", line 366, in _unbind_ports
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     port_client.update_port(port_id, port_req_body)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 102, in with_params
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     ret = self.function(instance, *args, **kwargs)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 549, in update_port
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     return self.put(self.port_path % (port), body=body)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 302, in put
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     headers=headers, params=params)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 270, in retry_request
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     headers=headers, params=params)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 211, in do_request
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     self._handle_fault_response(status_code, replybody)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 185, in _handle_fault_response
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     exception_handler_v20(status_code, des_error_body)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 83, in exception_handler_v20
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api     message=message)
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api NeutronClientException: 404 Not Found
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api 
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api The resource could not be found.
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api 
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api    
2015-08-11 23:14:04.344 11827 TRACE nova.network.neutronv2.api 

Expected results:

A started instance.

Additional info:

setsebool -P neutron_can_network 1 allows for instances to start.

# getsebool neutron_can_network
neutron_can_network --> off

# setsebool -P neutron_can_network 1
 
 
*****  Plugin catchall (11.6 confidence) suggests   **************************

If you believe that neutron-server should be allowed name_connect access on the port 5000 tcp_socket by default.
Then you should report this as a bug.

Additional Information:
Source Context                system_u:system_r:neutron_t:s0
Target Context                system_u:object_r:commplex_main_port_t:s0
Target Objects                port 5000 [ tcp_socket ]
Source                        neutron-server
Source Path                   neutron-server
Port                          5000
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.8.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     sts9.inf7.net
Platform                      Linux sts9.inf7.net 4.1.3-201.fc22.x86_64 #1 SMP
                              Wed Jul 29 19:50:22 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-08-11 23:09:06 CDT
Last Seen                     2015-08-11 23:09:06 CDT
Local ID                      6e84104d-7ff1-4f50-ba4a-27c034537646

Raw Audit Messages
type=AVC msg=audit(1439352546.695:67490): avc:  denied  { name_connect } for  pid=3280 comm="neutron-server" dest=5000 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:commplex_main_port_t:s0 tclass=tcp_socket permissive=0

Hash: neutron-server,neutron_t,commplex_main_port_t,tcp_socket,name_connect

Comment 1 Chandan Kumar 2016-05-19 15:40:58 UTC

This bug is against a Version which has reached End of Life.
If it's still present in supported release (http://releases.openstack.org), please update Version and reopen.

Note You need to log in before you can comment on or make changes to this bug.