Description of problem: Uploading nova pub key to overcloud doesn't work due to SELinux. Version-Release number of selected component (if applicable): openstack-selinux-0.6.42-2.el7ost.noarch How reproducible: 100% Steps to Reproduce: 1. source overcloudrc 2. nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey Actual results: ERROR (ConnectionRefused): Unable to establish connection to http://172.16.23.10:8774/v2/65d09be812be4d3a8853ac225706d1a9/os-keypairs Expected results: Upload succeeds. Additional info: type=AVC msg=audit(1447363073.695:606): avc: denied { execmem } for pid=3820 comm="nova-api" scontext=system_u:system_r:nova_t:s0 tcontext=system_u:system_r:nova_t:s0 tclass=process type=SYSCALL msg=audit(1447363073.695:606): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=1000 a2=7 a3=22 items=0 ppid=3771 pid=3820 auid=4294967295 uid=162 gid=162 euid=162 suid=162 fsuid=162 egid=162 sgid=162 fsgid=162 tty=(none) ses=4294967295 comm="nova-api" exe="/usr/bin/python2.7" subj=system_u:system_r:nova_t:s0 key=(null) type=ANOM_ABEND msg=audit(1447363073.697:607): auid=4294967295 uid=162 gid=162 ses=4294967295 subj=system_u:system_r:nova_t:s0 pid=3820 comm="nova-api" reason="memory violation" sig=11
See http://www.akkadia.org/drepper/selinux-mem.html
I added optional policy to deal with this for now. Would probably be best to go with mirek's solution for the future.
[stack@instack ~]$ nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey [stack@instack ~]$ nova keypair-list +---------+-------------------------------------------------+ | Name | Fingerprint | +---------+-------------------------------------------------+ | userkey | c9:38:8e:6c:06:bd:2a:9f:f4:ac:ab:ff:c7:58:73:00 | +---------+-------------------------------------------------+ openstack-selinux-0.6.52-1.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-0603.html