Bug 1267367 - fence_virtd cannot connect remotely due to selinux
fence_virtd cannot connect remotely due to selinux
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.1
All Linux
low Severity low
: rc
: ---
Assigned To: Simon Sekidde
Jan Zarsky
:
Depends On:
Blocks: 1262263 1331743
  Show dependency treegraph
 
Reported: 2015-09-29 15:38 EDT by Michele Baldessari
Modified: 2016-11-03 22:22 EDT (History)
9 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-80.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1331743 (view as bug list)
Environment:
Last Closed: 2016-11-03 22:22:47 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michele Baldessari 2015-09-29 15:38:40 EDT
Description of problem:
Likely this is a selinux issue, but first filing against fence-virt in case I
missed something obvious. This is my /etc/fence_virt.conf:
ence_virtd {
        listener = "multicast";
        backend = "libvirt";
}

listeners {
        multicast {
                key_file = "/etc/cluster/fence_xvm.key";
                address = "225.0.0.12";
                interface = "br-ctlplane";
        }
}

backends {
        libvirt { 
                uri = "qemu+ssh://root@192.168.122.1/system";
        }
}

Even with the following selinux booleans set to on:
setsebool -P fenced_can_ssh=on fenced_can_network_connect=on

I get the following AVC:
type=AVC msg=audit(1443550953.402:47395): avc:  denied  { setcap } for  pid=31310 comm=fence_virtd" scontext=system_u:system_r:fenced_t:s0 tcontext=system_u:system_r:fenced_t:s0 tclass=process

If I start fence_virtd via root or if I disable selinux it works correctly.

Version-Release number of selected component (if applicable):
fence-virt-0.3.2-1.el7.src.rpm
selinux-policy-targeted-3.13.1-23.el7_1.18.noarch

Feel free to reassign to selinux-policy if you agree with the analysis

How reproducible:
100%
Comment 2 Chris Feist 2015-10-14 15:51:32 EDT
Re-assigning this to selinux-policy since we're getting an avc denial when we're attempting to do normal fencing operations.
Comment 11 errata-xmlrpc 2016-11-03 22:22:47 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html

Note You need to log in before you can comment on or make changes to this bug.