Bug 1255559 - nova api can't be started in WSGI under httpd, blocked by selinux
nova api can't be started in WSGI under httpd, blocked by selinux
Status: CLOSED EOL
Product: RDO
Classification: Community
Component: openstack-selinux (Show other bugs)
unspecified
Unspecified Unspecified
unspecified Severity unspecified
: ---
: Kilo
Assigned To: Lon Hohberger
Ofer Blaut
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-20 20:13 EDT by Emilien Macchi
Modified: 2016-05-19 11:52 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-19 11:52:58 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Emilien Macchi 2015-08-20 20:13:25 EDT
Description of problem:
Nova API can't be run under WSGI if selinux is enforced.

Version-Release number of selected component (if applicable):
openstack-selinux 0.6.35-1.el7

How reproducible:
* Install openstack-nova-api
* Install openstack-selinux
* Configure Apache & nova to run under WSGI

Actual results:
Apache won't start:
Aug 21 00:11:32 em-vag-c7-dev httpd[4405]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:8773
Aug 21 00:11:32 em-vag-c7-dev httpd[4405]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:8773

Expected results:
Apache started, listening on 8773 and 8774 tcp ports.

Additional info:
audit.log: http://paste.fedoraproject.org/257401/01157491
Comment 1 Emilien Macchi 2015-08-20 20:17:21 EDT
Please note I have the same issue for 8774:

SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8774

details here: http://paste.fedoraproject.org/257403/44011622/
Comment 2 Chandan Kumar 2016-05-19 11:52:58 EDT
This bug is against a Version which has reached End of Life.
If it's still present in supported release (http://releases.openstack.org), please update Version and reopen.

Note You need to log in before you can comment on or make changes to this bug.