Bug 1284133 - Redis fails to restart in HA setup due to SELinux
Summary: Redis fails to restart in HA setup due to SELinux
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-selinux
Version: 8.0 (Liberty)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: beta
: 8.0 (Liberty)
Assignee: Ryan Hallisey
QA Contact: Marius Cornea
URL:
Whiteboard:
Depends On:
Blocks: 1284436
TreeView+ depends on / blocked
 
Reported: 2015-11-20 23:56 UTC by Marius Cornea
Modified: 2016-04-07 21:13 UTC (History)
9 users (show)

Fixed In Version: openstack-selinux-0.6.46-1.el7ost
Doc Type: Bug Fix
Doc Text:
Previously, SELinux prevented redis from connecting to its own port, resulting in redis failing at restart. With this update, redis has the permission to connect to the 'redis' labeled port. As a result, redis runs properly and resource restart is successful.
Clone Of:
: 1284436 (view as bug list)
Environment:
Last Closed: 2016-04-07 21:13:15 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:0603 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 8 Enhancement Advisory 2016-04-08 00:53:53 UTC

Description Marius Cornea 2015-11-20 23:56:15 UTC 
Description of problem:
Redis fails to restart in HA setup with 3 controllers due to SELinux 

Version-Release number of selected component (if applicable):
openstack-selinux-0.6.45-1.el7ost.noarch

How reproducible:
100%

Steps to Reproduce:
1. Deploy environment with 3 controllers
2. On one of the controllers run pcs resource restart redis-master
3. Watch the /var/log/audit/audit.log

Actual results:
type=AVC msg=audit(1448063445.338:2728): avc:  denied  { name_connect } for  pid=30202 comm="redis-server" dest=6379 scontext=system_u:system_r:redis_t:s0 tcontext=system_u:object_r:redis_port_t:s0 tclass=tcp_socket

The resouce fails to restart:
Error: Could not complete shutdown of redis-master, 1 resources remaining
Error performing operation: Timer expired

Expected results:
The resource is restarted.

Additional info:
Comment 4 Marius Cornea 2016-02-02 11:09:54 UTC 
openstack-selinux-0.6.52-1.el7ost.noarch
Comment 5 errata-xmlrpc 2016-04-07 21:13:15 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html
Note You need to log in before you can comment on or make changes to this bug.