Hide Forgot
I'm currently using keepalived 1.2.19-2.fc23 on Fedora 23 (x86_64). If I start keepalived manually on the command line, it will configure LVS real servers on v6 addresses without an issue. I can run ipvsadm and the IPv6 real servers appear along with their health checks. However, if I use systemd to start keepalived, the IPv6 real servers and health checks do not appear in ipvsadm. My system journal ends up with this repeated for each real server: IPVS: Operation not supported with specified address family
This appears to be an SELinux policy issue. After disabling dontaudit rules, I was able to get the following output from audit2allow: module keepalived_fix 1.0; require { type keepalived_t; class netlink_generic_socket { create getattr setopt bind write read }; } If I build that policy and apply it, keepalived can handle v6 virtual servers again.
commit 73f0863a3f131bf3c7d27352ccd0107442eae645 Author: Lukas Vrabec <lvrabec> Date: Thu Feb 25 16:14:38 2016 +0100 Allow keepalived to create netlink generic sockets. rhbz#1311756
Thanks so much for the quick fix, Lukas! :)
selinux-policy-3.13.1-158.9.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ffbae3a870
selinux-policy-3.13.1-158.9.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ffbae3a870
selinux-policy-3.13.1-158.9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.