Hide Forgot
Description of problem: Jan 27 05:11:28 localhost object-server: Error syncing with node: {'index': 0, 'replication_port': 6000, 'weight': 100.0, 'zone': 1, 'ip': 'fd00:fd00:fd00:4000::12', 'region': 1, 'id': 0, 'replication_ip': 'fd00:fd00:fd00:4000::12', 'meta': u'', 'device': 'd1', 'port': 6000}: #012Traceback (most recent call last):#012 File "/usr/lib/python2.7/site-packages/swift/obj/replicator.py", line 377, in update#012 success, _junk = self.sync(node, job, suffixes)#012 File "/usr/lib/python2.7/site-packages/swift/obj/replicator.py", line 111, in sync#012 return self.sync_method(node, job, suffixes, *args, **kwargs)#012 File "/usr/lib/python2.7/site-packages/swift/obj/replicator.py", line 203, in rsync#012 return self._rsync(args) == 0, {}#012 File "/usr/lib/python2.7/site-packages/swift/obj/replicator.py", line 135, in _rsync#012 stderr=subprocess.STDOUT)#012 File "/usr/lib/python2.7/site-packages/eventlet/green/subprocess.py", line 53, in __init__#012 subprocess_orig! .Popen.__init__(self, args, 0, *argss, **kwds)#012 File "/usr/lib64/python2.7/subprocess.py", line 711, in __init__#012 errread, errwrite)#012 File "/usr/lib64/python2.7/subprocess.py", line 1327, in _execute_child#012 raise child_exception#012OSError: [Errno 13] Permission denied from /var/log/audit: /var/log/audit/audit.log.1:18566:type=AVC msg=audit(1453889488.386:89570): avc: denied { execute } for pid=8553 comm="swift-object-re" name="rsync" dev="sda2" ino=2006949 scontext=system_u:system_r:swift_t:s0 tcontext=unconfined_u:object_r:rsync_exec_t:s0 tclass=file /var/log/audit/audit.log.1:18896:type=AVC msg=audit(1453889519.319:89753): avc: denied { execute } for pid=10332 comm="swift-object-re" name="rsync" dev="sda2" ino=2006949 scontext=system_u:system_r:swift_t:s0 tcontext=unconfined_u:object_r:rsync_exec_t:s0 tclass=file /var/log/audit/audit.log.1:20781:type=AVC msg=audit(1453889611.505:90723): avc: denied { execute } for pid=17526 comm="swift-object-re" name="rsync" dev="sda2" ino=2006949 scontext=system_u:system_r:swift_t:s0 tcontext=unconfined_u:object_r:rsync_exec_t:s0 tclass=file /var/log/audit/audit.log.1:21141:type=AVC msg=audit(1453889642.930:90916): avc: denied { execute } for pid=19499 comm="swift-object-re" name="rsync" dev="sda2" ino=2006949 scontext=system_u:system_r:swift_t:s0 tcontext=unconfined_u:object_r:rsync_exec_t:s0 tclass=file /var/log/audit/audit.log:8465:type=AVC msg=audit(1453897175.179:101020): avc: denied Version-Release number of selected component (if applicable): 7.0-RHEL-7-director/2016-01-22.1 python-tempest-lib-0.5.0-1.el7ost.noarch openstack-tempest-kilo-20151020.1.el7ost.noarch
Can you run this in permissive and report back the AVCs you get? This could require a transition depending if there are a lot of related AVC returned. If there arn't any more, I can just add the one allow rule. $ setenforce 0 run tests $ cat /var/log/audit/audit.log | grep AVC
Asaf can you capture the AVCs in a text doc? I don't use jenkins a whole lot so I don't know where I can find the AVCs within those results.
Try this policy. It's based on the only rule I have here. I'm not too confident it will work, but there's a chance.
Does this cause deployment failures?
ospd 7.3 with openstack-selinux-0.6.55-1.el7ost. no errors from swift.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0437.html
Ryan Hallisey,
removed flags of need info as the information couldn't be supplied. please contact me if needed.
*** Bug 1235710 has been marked as a duplicate of this bug. ***