When running Cinder API in WSGI with Apache and SElinux enforce, we have an AVC: SELinux is preventing /usr/sbin/httpd from open access on the file /var/log/cinder/cinder-api.log. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that httpd should be allowed open access on the cinder-api.log file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context unconfined_u:object_r:cinder_log_t:s0 Target Objects /var/log/cinder/cinder-api.log [ file ] Source httpd Source Path /usr/sbin/httpd Port <Unknown> Host <Unknown> Source RPM Packages httpd-2.4.6-40.el7.centos.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-60.el7_2.3.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name jenkins Platform Linux jenkins 3.10.0-327.4.5.el7.x86_64 #1 SMP Mon Jan 25 22:07:14 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-04-10 03:10:14 UTC Last Seen 2016-04-10 03:10:14 UTC Local ID b2e89cf7-071d-4fbf-9a04-f9d0443a70da Raw Audit Messages type=AVC msg=audit(1460257814.82:8553): avc: denied { open } for pid=14325 comm="httpd" path="/var/log/cinder/cinder-api.log" dev="vda1" ino=318834799 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:cinder_log_t:s0 tclass=file type=SYSCALL msg=audit(1460257814.82:8553): arch=x86_64 syscall=open success=no exit=EACCES a0=7ff334004ee0 a1=441 a2=1b6 a3=24 items=0 ppid=14308 pid=14325 auid=4294967295 uid=165 gid=165 euid=165 suid=165 fsuid=165 egid=165 sgid=165 fsgid=165 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null) Hash: httpd,httpd_t,cinder_log_t,file,open
Just need acks and I'll build openstack-selinux-0.6.59
I still have an AVC with 0.6.59: type=AVC msg=audit(1460418573.405:3254): avc: denied { write } for pid=2191 comm="httpd" name="cinder" dev="vda1" ino=117531620 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:cinder_log_t:s0 tclass=dir type=SYSCALL msg=audit(1460418573.405:3254): arch=c000003e syscall=2 success=no exit=-13 a0=7f814a5f8530 a1=441 a2=1b6 a3=24 items=0 ppid=2176 pid=2191 auid=4294967295 uid=165 gid=165 euid=165 suid=165 fsuid=165 egid=165 sgid=165 fsgid=165 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
SELinux is preventing /usr/sbin/httpd from write access on the directory cinder. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that httpd should be allowed write access on the cinder directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:cinder_log_t:s0 Target Objects cinder [ dir ] Source httpd Source Path /usr/sbin/httpd Port <Unknown> Host <Unknown> Source RPM Packages httpd-2.4.6-40.el7.centos.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-60.el7_2.3.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name jenkins Platform Linux jenkins 3.10.0-327.4.5.el7.x86_64 #1 SMP Mon Jan 25 22:07:14 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-04-11 23:50:46 UTC Last Seen 2016-04-11 23:50:46 UTC Local ID c6a6dc1b-96d6-4162-b2eb-4c53ea713210 Raw Audit Messages type=AVC msg=audit(1460418646.779:3276): avc: denied { write } for pid=2209 comm="httpd" name="cinder" dev="vda1" ino=117531620 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:cinder_log_t:s0 tclass=dir type=SYSCALL msg=audit(1460418646.779:3276): arch=x86_64 syscall=open success=no exit=EACCES a0=7f81380113c0 a1=441 a2=1b6 a3=24 items=0 ppid=2176 pid=2209 auid=4294967295 uid=165 gid=165 euid=165 suid=165 fsuid=165 egid=165 sgid=165 fsgid=165 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null) Hash: httpd,httpd_t,cinder_log_t,dir,write
Created attachment 1146169 [details] Fix httpd write in cinder log directory Should fix the last issue
Created attachment 1146172 [details] Fix httpd write in cinder log directory Update patch
The fix works fine, Puppet OpenStack CI is current gating on this package to deploy Cinder in WSGI app with apache: https://github.com/openstack/puppet-openstack-integration/blob/master/manifests/cinder.pp#L69
Based on comment 8 - verified. openstack-selinux-0.7.3-3.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-1597.html