Description of problem: The OVS connections to ports 6622 and 6633 seems to be blocked when Enforcing. That makes the ovs connection resets. When Enforcing ==> /var/log/openvswitch/ovs-vswitchd.log <== 2015-09-02T14:27:35.266Z|00044|rconn|INFO|pool<->ssl:10.34.69.204:6633: connecting... 2015-09-02T14:27:35.276Z|00045|rconn|INFO|pool<->ssl:10.34.69.204:6633: connected 2015-09-02T14:27:35.279Z|00046|rconn|INFO|pool<->ssl:10.34.69.204:6633: connection closed by peer 2015-09-02T14:27:35.279Z|00047|rconn|INFO|pool<->ssl:10.34.69.204:6633: waiting 2 seconds before reconnect 2015-09-02T14:27:36.265Z|00048|rconn|INFO|br-int<->unix:ovs-l3d.mgmt: connecting... 2015-09-02T14:27:36.265Z|00049|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory) 2015-09-02T14:27:36.265Z|00050|rconn|INFO|br-int<->unix:ovs-l3d.mgmt: waiting 4 seconds before reconnect ==> /var/log/audit/audit.log <== type=AVC msg=audit(1441204057.176:32748): avc: denied { name_connect } for pid=23947 comm="ovsdb-server" dest=6632 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1441204057.176:32748): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7fffb06074c0 a2=10 a3=0 items=0 ppid=23946 pid=23947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ovsdb-server" exe="/usr/sbin/ovsdb-server" subj=system_u:system_r:openvswitch_t:s0 key=(null) ==> /var/log/openvswitch/ovs-vswitchd.log <== 2015-09-02T14:27:37.266Z|00051|rconn|INFO|pool<->ssl:10.34.69.204:6633: connecting... 2015-09-02T14:27:37.275Z|00052|rconn|INFO|pool<->ssl:10.34.69.204:6633: connected 2015-09-02T14:27:37.275Z|00053|rconn|INFO|pool<->ssl:10.34.69.204:6633: connection closed by peer 2015-09-02T14:27:37.275Z|00054|rconn|INFO|pool<->ssl:10.34.69.204:6633: waiting 4 seconds before reconnect ==> /var/log/audit/audit.log <== type=AVC msg=audit(1441204059.140:32749): avc: denied { search } for pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir type=SYSCALL msg=audit(1441204059.140:32749): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null) After setenforce 0 ==> /var/log/audit/audit.log <== type=AVC msg=audit(1441204354.383:32858): avc: denied { search } for pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir type=SYSCALL msg=audit(1441204354.383:32858): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null) ==> /var/log/openvswitch/ovs-vswitchd.log <== 2015-09-02T14:32:36.266Z|00150|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory) ==> /var/log/audit/audit.log <== type=AVC msg=audit(1441204359.384:32859): avc: denied { search } for pid=23982 comm="system_stats4" name="node" dev="sda1" ino=42410035 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir type=SYSCALL msg=audit(1441204359.384:32859): arch=c000003e syscall=137 success=no exit=-13 a0=7f14a3ffd8db a1=7f14a3ffd6c0 a2=1 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null) type=MAC_STATUS msg=audit(1441204360.325:32860): enforcing=0 old_enforcing=1 auid=0 ses=1919 type=SYSCALL msg=audit(1441204360.325:32860): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff13424aa0 a2=1 a3=7fff13424820 items=0 ppid=21103 pid=24330 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1919 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ==> /var/log/openvswitch/ovs-vswitchd.log <== 2015-09-02T14:32:44.266Z|00151|rconn|WARN|br-int<->unix:ovs-l3d.mgmt: connection failed (No such file or directory) ==> /var/log/audit/audit.log <== type=AVC msg=audit(1441204364.388:32861): avc: denied { getattr } for pid=23982 comm="system_stats4" path="/srv/node/swiftloopback" dev="loop0" ino=2 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:swift_data_t:s0 tclass=dir type=SYSCALL msg=audit(1441204364.388:32861): arch=c000003e syscall=4 success=yes exit=0 a0=7f14a3ffd8db a1=7f14a3ffd740 a2=7f14a3ffd740 a3=2 items=0 ppid=23956 pid=23982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system_stats4" exe="/usr/sbin/ovs-vswitchd" subj=system_u:system_r:openvswitch_t:s0 key=(null) Version-Release number of selected component (if applicable): openstack-selinux-0.6.37-1.el7ost.noarch How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: ovs unable to connect to NSX Expected results: ovs unable connect to NSX both - management and controller connections Additional info:
We don't have a licence for nsx moving to OtherQA
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-0603.html