Bug 1281588 - Uploading nova pub key to overcloud fails due to SELinux
Uploading nova pub key to overcloud fails due to SELinux
Status: CLOSED ERRATA
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-selinux (Show other bugs)
8.0 (Liberty)
Unspecified Unspecified
high Severity high
: beta
: 8.0 (Liberty)
Assigned To: Ryan Hallisey
Marius Cornea
: Triaged
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-12 16:18 EST by Marius Cornea
Modified: 2016-04-07 17:12 EDT (History)
11 users (show)

See Also:
Fixed In Version: openstack-selinux-0.6.45-1.el7ost
Doc Type: Bug Fix
Doc Text:
Prior to this update, SELinux prevented nova from uploading the public key to the overcloud. A new rule has now been added to allow nova to upload the key.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-04-07 17:12:04 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marius Cornea 2015-11-12 16:18:49 EST
Description of problem:
Uploading nova pub key to overcloud doesn't work due to SELinux.

Version-Release number of selected component (if applicable):
openstack-selinux-0.6.42-2.el7ost.noarch

How reproducible:
100%

Steps to Reproduce:
1. source overcloudrc
2. nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey

Actual results:
ERROR (ConnectionRefused): Unable to establish connection to http://172.16.23.10:8774/v2/65d09be812be4d3a8853ac225706d1a9/os-keypairs

Expected results:
Upload succeeds.

Additional info:
type=AVC msg=audit(1447363073.695:606): avc:  denied  { execmem } for  pid=3820 comm="nova-api" scontext=system_u:system_r:nova_t:s0 tcontext=system_u:system_r:nova_t:s0 tclass=process
type=SYSCALL msg=audit(1447363073.695:606): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=1000 a2=7 a3=22 items=0 ppid=3771 pid=3820 auid=4294967295 uid=162 gid=162 euid=162 suid=162 fsuid=162 egid=162 sgid=162 fsgid=162 tty=(none) ses=4294967295 comm="nova-api" exe="/usr/bin/python2.7" subj=system_u:system_r:nova_t:s0 key=(null)
type=ANOM_ABEND msg=audit(1447363073.697:607): auid=4294967295 uid=162 gid=162 ses=4294967295 subj=system_u:system_r:nova_t:s0 pid=3820 comm="nova-api" reason="memory violation" sig=11
Comment 2 Miroslav Grepl 2015-11-13 02:35:30 EST
See http://www.akkadia.org/drepper/selinux-mem.html
Comment 3 Ryan Hallisey 2015-11-18 12:08:44 EST
I added optional policy to deal with this for now.  Would probably be best to go with mirek's solution for the future.
Comment 7 Ronnie Rasouli 2016-01-31 15:45:30 EST
[stack@instack ~]$ nova keypair-add --pub_key ~/.ssh/id_rsa.pub userkey
[stack@instack ~]$ nova keypair-list
+---------+-------------------------------------------------+
| Name    | Fingerprint                                     |
+---------+-------------------------------------------------+
| userkey | c9:38:8e:6c:06:bd:2a:9f:f4:ac:ab:ff:c7:58:73:00 |
+---------+-------------------------------------------------+
openstack-selinux-0.6.52-1.el7ost.noarch
Comment 8 errata-xmlrpc 2016-04-07 17:12:04 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html

Note You need to log in before you can comment on or make changes to this bug.