Bug 1313617 – selinux blocks access to glance-api" name="/" dev="tmpfs"

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1313617 - selinux blocks access to glance-api" name="/" dev="tmpfs"

Summary:	selinux blocks access to glance-api" name="/" dev="tmpfs"

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-selinux (Show other bugs)
Sub Component:
Version:	8.0 (Liberty)
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	ga
Target Release:	8.0 (Liberty)
Assigned To:	Ryan Hallisey
QA Contact:	bkopilov
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-03-01 23:23 EST by bkopilov
Modified:	2016-04-07 17:32 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	openstack-selinux-0.6.58-1.el7ost
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-04-07 17:32:11 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2016:0603	normal	SHIPPED_LIVE	Red Hat OpenStack Platform 8 Enhancement Advisory	2016-04-07 20:53:53 EDT

Groups: None (edit)

Description bkopilov 2016-03-01 23:23:12 EST

Description of problem:
Dell installed Beta7 , 3 controllers + 3 computes .
versions :
openstack-selinux-0.6.53-1.el7ost.noarch
python-glance-store-0.9.1-1.el7ost.noarch
python-glance-11.0.1-3.el7ost.noarch
python-glanceclient-1.1.0-1.el7ost.noarch
openstack-glance-11.0.1-3.el7ost.noarch



Selinux denies :

/var/log/audit/audit.log.2:23935:type=AVC msg=audit(1456857432.481:34143): avc:  denied  { getattr } for  pid=91939 comm="glance-api" name="/" dev="tmpfs" ino=1236 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem
/var/log/audit/audit.log.2:23937:type=AVC msg=audit(1456857432.481:34144): avc:  denied  { getattr } for  pid=91939 comm="glance-api" name="/" dev="tmpfs" ino=1236 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 bkopilov 2016-03-01 23:28:17 EST

Not sure if its related but in /var/log/messages there is a flood with message:

Mar  1 11:02:20 localhost glance-api: libust[72821/144429]: Error: Error opening shm /lttng-ust-wait-5-161 (in get_wait_shm() at lttng-ust-comm.c:886)
Mar  1 11:02:20 localhost glance-api: libust[72821/144428]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:886)
Mar  1 11:02:25 localhost glance-api: libust[72821/144429]: Error: Error opening shm /lttng-ust-wait-5-161 (in get_wait_shm() at lttng-ust-comm.c:886)
Mar  1 11:02:25 localhost glance-api: libust[72821/144428]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:886)


Benny

Comment 6 bkopilov 2016-04-06 05:57:05 EDT

did not manage to reproduce
Benny

Comment 7 errata-xmlrpc 2016-04-07 17:32:11 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html

Note You need to log in before you can comment on or make changes to this bug.