1344500 – rhsmcertd fails to see /etc/docker/certs.d/ when selinux is Enforcing

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1344500 - rhsmcertd fails to see /etc/docker/certs.d/ when selinux is Enforcing

Summary: rhsmcertd fails to see /etc/docker/certs.d/ when selinux is Enforcing

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	selinux-policy
Sub Component:
Version:	7.3
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	Lukas Vrabec
QA Contact:	Milos Malik
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2016-06-09 19:49 UTC by John Sefler
Modified:	2016-11-04 02:31 UTC (History)
CC List:	12 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-11-04 02:31:37 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Bugzilla	1331457	1	None	None	None	2021-01-20 06:05:38 UTC
Red Hat Product Errata	RHBA-2016:2283	0	normal	SHIPPED_LIVE	selinux-policy bug fix and enhancement update	2016-11-03 13:36:25 UTC

Internal Links: 1331457

Description John Sefler 2016-06-09 19:49:27 UTC

Description of problem:
On a system with docker and subscription-manager-plugin-container installed, attaching a subscription that provides "containerimage" content should copy the entitlement to the configured /etc/docker/certs.d/ registries as defined in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf

The problem is that when rhsmcertd runs (while in enforcing mode), it appears to be blocked from seeing the /etc/docker/certs.d/ directories.  However if selinux is set to permissve, then life is good - rhsmcertd can see the    /etc/docker/certs.d/ directories and finish its job.

Hence this appears to be an selinux issue, but I'm not an expert on troubleshooting the selinux policy.


Version-Release number of selected component (if applicable):
[root@jsefler-rhel7 ~]# rpm -qa | egrep "subscription-manager-plugin-container|docker|selinux"
selinux-policy-targeted-3.13.1-76.el7.noarch
selinux-policy-3.13.1-76.el7.noarch
docker-selinux-1.8.2-8.el7.x86_64
libselinux-utils-2.5-3.el7.x86_64
libselinux-python-2.5-3.el7.x86_64
subscription-manager-plugin-container-1.17.6-1.el7.x86_64
libselinux-2.5-3.el7.x86_64
docker-1.8.2-8.el7.x86_64


How reproducible:


Steps to Reproduce:
1. install docker (from extras) and its policy and the subscription-manager-plugin-container

2. register and attach a subscription that provides "containerimage" content

3. With selinux enforcing, restart the rhsmcertd, wait for two minutes, and tail /var/log/rhsm/rhsm.log ...

[root@jsefler-rhel7 ~]# setenforce 1
[root@jsefler-rhel7 ~]# getenforce
Enforcing
[root@jsefler-rhel7 ~]# systemctl restart rhsmcertd.service && sleep 120
[root@jsefler-rhel7 ~]# tail -f /var/log/rhsm/rhsm.log

2016-06-09 15:24:48,780 [DEBUG] rhsmcertd-worker:6380 @plugins.py:769 - Running update_content_hook in container_content.ContainerContentPlugin
2016-06-09 15:24:48,781 [DEBUG] rhsmcertd-worker:6380 @base_action_client.py:85 - running lib: <subscription_manager.content_action_client.ContentPluginActionInvoker object at 0x18a3690>
2016-06-09 15:24:48,781 [INFO] rhsmcertd-worker:6380 @container_content.py:43 - Updating container content.
2016-06-09 15:24:48,781 [INFO] rhsmcertd-worker:6380 @container_content.py:45 - registry hostnames = registry.access.redhat.com,cdn.redhat.com,access.redhat.com
2016-06-09 15:24:48,781 [DEBUG] rhsmcertd-worker:6380 @__init__.py:85 - Searching for content of type: containerimage
2016-06-09 15:24:48,781 [DEBUG] rhsmcertd-worker:6380 @container.py:53 - Got content_sets: [<subscription_manager.model.ent_cert.EntitlementCertContent object at 0x18a3350>]
2016-06-09 15:24:48,781 [DEBUG] rhsmcertd-worker:6380 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/registry.access.redhat.com
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:141 - Exiting plugin
2016-06-09 15:24:48,782 [DEBUG] rhsmcertd-worker:6380 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/cdn.redhat.com
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:141 - Exiting plugin
2016-06-09 15:24:48,782 [DEBUG] rhsmcertd-worker:6380 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/access.redhat.com
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-06-09 15:24:48,782 [WARNING] rhsmcertd-worker:6380 @container.py:141 - Exiting plugin


BANG! Notice that the log is complaining with WARNINGs that "Container cert directory does not exist: /etc/docker/certs.d/"
That's not true.  It does exist...

[root@jsefler-rhel7 ~]# ls -l /etc/docker/certs.d/
total 4
drwxr-xr-x. 2 root root   67 Jun  9 14:50 access.redhat.com
drwxr-xr-x. 2 root root 4096 Jun  9 15:09 cdn.redhat.com
drwxr-xr-x. 2 root root   26 Jun  9 15:04 redhat.com
drwxr-xr-x. 2 root root   26 Jun  9 15:04 redhat.io
drwxr-xr-x. 2 root root   67 Jun  9 14:50 registry.access.redhat.com
drwxr-xr-x. 2 root root   67 Jun  9 14:50 registry.redhat.io

4. Now when I disable selinux, rhsmcertd can complete it's job...

[root@jsefler-rhel7 ~]# setenforce 0
[root@jsefler-rhel7 ~]# getenforce
Permissive
[root@jsefler-rhel7 ~]# systemctl restart rhsmcertd.service && sleep 120
[root@jsefler-rhel7 ~]# tail -f /var/log/rhsm/rhsm.log


2016-06-09 15:40:28,169 [DEBUG] rhsmcertd-worker:7516 @plugins.py:769 - Running update_content_hook in container_content.ContainerContentPlugin
2016-06-09 15:40:28,169 [DEBUG] rhsmcertd-worker:7516 @base_action_client.py:85 - running lib: <subscription_manager.content_action_client.ContentPluginActionInvoker object at 0x16f2690>
2016-06-09 15:40:28,169 [INFO] rhsmcertd-worker:7516 @container_content.py:43 - Updating container content.
2016-06-09 15:40:28,169 [INFO] rhsmcertd-worker:7516 @container_content.py:45 - registry hostnames = registry.access.redhat.com,cdn.redhat.com,access.redhat.com
2016-06-09 15:40:28,169 [DEBUG] rhsmcertd-worker:7516 @__init__.py:85 - Searching for content of type: containerimage
2016-06-09 15:40:28,169 [DEBUG] rhsmcertd-worker:7516 @container.py:53 - Got content_sets: [<subscription_manager.model.ent_cert.EntitlementCertContent object at 0x16f2350>]
2016-06-09 15:40:28,170 [DEBUG] rhsmcertd-worker:7516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/registry.access.redhat.com
2016-06-09 15:40:28,170 [DEBUG] rhsmcertd-worker:7516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/cdn.redhat.com
2016-06-09 15:40:28,170 [DEBUG] rhsmcertd-worker:7516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/access.redhat.com

SUCCESS: The log shows successful "Syncing container certificates to /etc/docker/certs.d/"...


Expected Results:
The rhsmcertd worker should successfully complete "Syncing container certificates"... when selinux is enforcing.

Comment 3 Miroslav Grepl 2016-06-29 08:10:42 UTC

Could you please attach raw AVC messages?

Comment 4 John Sefler 2016-07-13 14:37:13 UTC

Retesting again with the aid of https://wiki.test.redhat.com/BaseOs/Security/SelinuxTestOnlyBugs#SELinuxHowToTestInstructions

1. Update selinux-policy* packages to the recent version. You should be
able to find required version in selinux-policy errata, related selinux-policy
bug or Brew. If you are not sure about the version, ask selinux-policy errata QE
owner.

[root@jsefler-rhel7 ~]# rpm -qa | egrep "subscription-manager-plugin-container|docker|selinux"
selinux-policy-3.13.1-85.el7.noarch
docker-1.10.3-44.el7.x86_64
subscription-manager-plugin-container-1.17.8-1.el7.x86_64
libselinux-python-2.5-4.el7.x86_64
docker-common-1.10.3-44.el7.x86_64
libselinux-utils-2.5-4.el7.x86_64
docker-rhel-push-plugin-1.10.3-44.el7.x86_64
libselinux-2.5-4.el7.x86_64
selinux-policy-targeted-3.13.1-85.el7.noarch
docker-selinux-1.10.3-44.el7.x86_64
docker-forward-journald-1.10.3-44.el7.x86_64


2. Ensure audit daemon is installed and running:
# service auditd restart

[root@jsefler-rhel7 ~]# service auditd restart
Stopping logging:                                          [  OK  ]
Redirecting start to /bin/systemctl start auditd.service
[root@jsefler-rhel7 ~]# systemctl status auditd.service | grep Active
   Active: active (running) since Wed 2016-07-13 10:14:24 EDT; 14s ago
[root@jsefler-rhel7 ~]# 

 
3. Ensure you are in enforcing mode:
# setenforce 1

[root@jsefler-rhel7 ~]# setenforce 1
[root@jsefler-rhel7 ~]# getenforce
Enforcing


4. Make sure that the file-system(s) on testing machine(s) are labelled correctly. Based on previous bugs, the majority of mislabelled files is located in /etc, /run and /var directories:
# restorecon -Rv /etc /run /var

[root@jsefler-rhel7 ~]# restorecon -Rv /etc /run /var
restorecon:  Warning no default label for /run/lvmetad.pid
restorecon:  Warning no default label for /run/lock/subsys
restorecon:  Warning no default label for /run/lock/subsys/network
restorecon:  Warning no default label for /run/lock/subsys/rhnsd
restorecon:  Warning no default label for /run/initramfs
restorecon:  Warning no default label for /run/initramfs/rwtab
restorecon:  Warning no default label for /run/initramfs/state
restorecon:  Warning no default label for /run/initramfs/state/var
restorecon:  Warning no default label for /run/initramfs/state/var/lib
restorecon:  Warning no default label for /run/initramfs/state/var/lib/dhclient
restorecon:  Warning no default label for /run/initramfs/state/etc
restorecon:  Warning no default label for /run/initramfs/state/etc/sysconfig
restorecon:  Warning no default label for /run/initramfs/state/etc/sysconfig/network-scripts
restorecon:  Warning no default label for /run/initramfs/.need_shutdown
restorecon:  Warning no default label for /run/initramfs/log
etcetera....

5. Store the current date/time:
# START_DATE_TIME=`date "+%m/%d/%Y %T"`
 
[root@jsefler-rhel7 ~]# START_DATE_TIME=`date "+%m/%d/%Y %T"`
[root@jsefler-rhel7 ~]# echo $START_DATE_TIME
07/13/2016 10:16:39
[root@jsefler-rhel7 ~]# 


6. Run your automated/manual test cases.


[root@jsefler-rhel7 ~]# subscription-manager list --consumed
+-------------------------------------------+
   Consumed Subscriptions
+-------------------------------------------+
Subscription Name:   Red Hat Enterprise Linux Academic Site Subscription (Server, Desktop, Workstation, POWER, HPC), Premium with Smart Management per FTE
Provides:            Oracle Java (for RHEL Server)
                     Red Hat Enterprise Linux Workstation
                     Red Hat Enterprise Linux Desktop
                     Oracle Java (for RHEL Client)
                     Red Hat Software Collections (for RHEL Client)
                     dotNET on RHEL Beta (for RHEL Server)
                     Red Hat Beta
                     Red Hat Enterprise Linux Atomic Host Beta
                     Red Hat Developer Toolset (for RHEL Server)
                     Red Hat Software Collections Beta (for RHEL Client)
                     Red Hat Container Images Beta
                     Red Hat Enterprise Linux for Power, little endian
                     Red Hat Developer Toolset (for RHEL Workstation)
                     Red Hat Enterprise Linux for SAP
                     Oracle Java (for RHEL Workstation)
                     Red Hat Enterprise Linux Atomic Host
                     Red Hat Enterprise Linux Server
                     Red Hat Enterprise Linux for Power, big endian
                     Red Hat Software Collections (for RHEL Server)
                     dotNET on RHEL (for RHEL Server)
                     Red Hat Software Collections (for RHEL Workstation)
                     Red Hat Software Collections Beta (for RHEL Server)
                     Red Hat Container Images
                     Red Hat Enterprise Linux for Scientific Computing
                     Red Hat Software Collections Beta (for RHEL Workstation)
                     Oracle Java (for RHEL Compute Node)
SKU:                 RH2501844
Contract:            11000768
Account:             5699539
Serial:              8461870041656734973
Pool ID:             8a99f9815582f734015585f9a676527f
Provides Management: Yes
Active:              True
Quantity Used:       1
Service Level:       Premium
Service Type:        L1-L3
Status Details:      Subscription is current
Subscription Type:   Standard
Starts:              05/28/2016
Ends:                05/27/2017
System Type:         Virtual

[root@jsefler-rhel7 ~]# systemctl restart rhsmcertd.service && sleep 120
[root@jsefler-rhel7 ~]# 
[root@jsefler-rhel7 ~]# grep WARNING /var/log/rhsm/rhsm.log
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:141 - Exiting plugin
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:141 - Exiting plugin
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:141 - Exiting plugin
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:140 - Container cert directory does not exist: /etc/docker/certs.d/
2016-07-13 10:19:18,266 [WARNING] rhsmcertd-worker:9986 @container.py:141 - Exiting plugin
[root@jsefler-rhel7 ~]# 
[root@jsefler-rhel7 ~]# ls -l /etc/docker/certs.d/
total 4
drwxr-xr-x. 2 root root   67 Jul 13 09:43 access.redhat.com
drwxr-xr-x. 2 root root 4096 Jul 13 09:43 cdn.redhat.com
drwxr-xr-x. 2 root root   26 Jul 13 09:47 redhat.com
drwxr-xr-x. 2 root root   26 Jul 13 09:47 redhat.io
drwxr-xr-x. 2 root root   67 Jul 13 09:43 registry.access.redhat.com
drwxr-xr-x. 2 root root   67 Jul 13 09:43 registry.redhat.io
[root@jsefler-rhel7 ~]# 


7. Once finished, check that there were no SELinux denials during the testing:
# ausearch -m AVC -m USER_AVC -m SELINUX_ERR -i -ts ${START_DATE_TIME}

[root@jsefler-rhel7 ~]# ausearch -m AVC -m USER_AVC -m SELINUX_ERR -i -ts ${START_DATE_TIME}
----
type=SYSCALL msg=audit(07/13/2016 10:19:18.657:176884) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x7f3d6b9b84b0 a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x24 items=0 ppid=9956 pid=9986 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rhsmcertd-worke exe=/usr/bin/python2.7 subj=system_u:system_r:rhsmcertd_t:s0 key=(null) 
type=AVC msg=audit(07/13/2016 10:19:18.657:176884) : avc:  denied  { search } for  pid=9986 comm=rhsmcertd-worke name=net dev="proc" ino=54269 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir 
[root@jsefler-rhel7 ~]# 



BANG!  Hopefully the denials above can help solve this bug.

Comment 5 John Sefler 2016-07-13 14:41:21 UTC

Additional Test: If I follow-up comment 4 with a re-run using setenforce 0, I get a completely different list of AVC denials (shown below), but subscription-manager-plugin-container behavior works as expected without any WARNINGs about "Container cert directory does not exist"

[root@jsefler-rhel7 ~]# echo ${START_DATE_TIME}
07/13/2016 10:28:30
[root@jsefler-rhel7 ~]# ausearch -m AVC -m USER_AVC -m SELINUX_ERR -i -ts ${START_DATE_TIME}
----
type=USER_AVC msg=audit(07/13/2016 10:28:47.248:176930) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=SYSCALL msg=audit(07/13/2016 10:30:52.702:176947) : arch=x86_64 syscall=open success=yes exit=5 a0=0x7f93a29164b0 a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x24 items=0 ppid=10217 pid=10252 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rhsmcertd-worke exe=/usr/bin/python2.7 subj=system_u:system_r:rhsmcertd_t:s0 key=(null) 
type=AVC msg=audit(07/13/2016 10:30:52.702:176947) : avc:  denied  { open } for  pid=10252 comm=rhsmcertd-worke path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=2571534 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file 
type=AVC msg=audit(07/13/2016 10:30:52.702:176947) : avc:  denied  { read } for  pid=10252 comm=rhsmcertd-worke name=disable_ipv6 dev="proc" ino=2571534 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file 
type=AVC msg=audit(07/13/2016 10:30:52.702:176947) : avc:  denied  { search } for  pid=10252 comm=rhsmcertd-worke name=net dev="proc" ino=54269 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir 
----
type=SYSCALL msg=audit(07/13/2016 10:30:52.702:176948) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x5 a1=0x7ffd96cd8510 a2=0x7ffd96cd8510 a3=0x0 items=0 ppid=10217 pid=10252 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rhsmcertd-worke exe=/usr/bin/python2.7 subj=system_u:system_r:rhsmcertd_t:s0 key=(null) 
type=AVC msg=audit(07/13/2016 10:30:52.702:176948) : avc:  denied  { getattr } for  pid=10252 comm=rhsmcertd-worke path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=2571534 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file 
[root@jsefler-rhel7 ~]#

Comment 7 John Sefler 2016-07-13 14:56:58 UTC

[root@jsefler-rhel7 ~]# ls -lZ /etc/docker/certs.d/
drwxr-xr-x. root root unconfined_u:object_r:cert_t:s0  access.redhat.com
drwxr-xr-x. root root system_u:object_r:cert_t:s0      cdn.redhat.com
drwxr-xr-x. root root system_u:object_r:cert_t:s0      redhat.com
drwxr-xr-x. root root system_u:object_r:cert_t:s0      redhat.io
drwxr-xr-x. root root unconfined_u:object_r:cert_t:s0  registry.access.redhat.com
drwxr-xr-x. root root unconfined_u:object_r:cert_t:s0  registry.redhat.io

Comment 9 Milos Malik 2016-07-14 06:40:12 UTC

If rhsmcertd-worker was able to access /etc/docker directory then it would be also able to access /etc/docker/certs.d directory, but it isn't so:

# matchpathcon /etc/docker/certs.d/
/etc/docker/certs.d	system_u:object_r:cert_t:s0
# sesearch -s rhsmcertd_t -t cert_t -c dir -A -C
Found 1 semantic av rules:
   allow rhsmcertd_t cert_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ; 

# matchpathcon /etc/docker
/etc/docker	system_u:object_r:docker_config_t:s0
# sesearch -s rhsmcertd_t -t docker_config_t -c dir -A -C

#

There is a dontaudit rule for /etc/docker, that's why we don't see additional AVCs.

# sesearch -s rhsmcertd_t -t docker_config_t -c dir -D -C
Found 1 semantic av rules:
   dontaudit application_domain_type non_security_file_type : dir { getattr search open } ; 

#

Comment 10 Miroslav Grepl 2016-07-14 09:35:39 UTC

Ok, it makes sense. 

Milos,
are you able to reproduce it?

Comment 11 Milos Malik 2016-07-14 09:41:16 UTC

I haven't tried yet.

Comment 14 John Sefler 2016-07-14 12:20:25 UTC

Based on the troubleshooting above (and the slight offset in the timestamps), the AVC denials in comment 4 do not appear to be related to the inability to access /etc/docker/certs.d/ .  However, the AVC denials are real and appear to be a duplicate report of https://bugzilla.redhat.com/show_bug.cgi?id=1331457#c3

Comment 17 Shwetha Kallesh 2016-07-15 15:13:32 UTC

-bash-4.2# rpm -qa | grep selinux
    libselinux-2.5-4.el7.x86_64
    selinux-policy-3.13.1-88.el7.noarch
    docker-selinux-1.10.3-44.el7.x86_64
    libselinux-utils-2.5-4.el7.x86_64
    selinux-policy-targeted-3.13.1-88.el7.noarch
    libselinux-python-2.5-4.el7.x86_64

Dont see any "Container cert directory does not exist: /etc/docker/certs.d/" message in the log and rhsmcertd successfully completes "syncing container certs"

-bash-4.2# service docker restart
Redirecting to /bin/systemctl restart  docker.service
-bash-4.2# subscription-manager register --force
The system with UUID 3c2c7cdf-3486-4608-be28-3fc7e3baf6a8 has been unregistered
Registering to: subscription.rhn.stage.redhat.com:443/subscription
Username: qa
Password:
The system has been registered with ID: bc950eac-8535-428a-aacb-009191b1a06d

-bash-4.2# subscription-manager attach --auto
Installed Product Current Status:
Product Name: Red Hat Enterprise Linux Server
Status:       Subscribed
     
-bash-4.2# getenforce
Enforcing

-bash-4.2# rct cat-cert /etc/pki/entitlement/7351137234201293365.pem | grep container
            Type: containerimage
            Label: cf-me-5.6-for-rhel-7-containers
            URL: /content/dist/cf-me/server/5.6/$basearch/containers
            Type: containerimage
            Label: rhel-7-server-jb-eap-7.0-containers
            URL: /content/dist/rhel/server/7/7Server/$basearch/jbeap/7.0/containers
            Type: containerimage
            Label: rhel-server-rhscl-7-beta-containers
            URL: /content/beta/rhel/server/7/$basearch/rhscl/1/containers
            Type: containerimage
            Label: rhel-server-rhscl-7-containers
            URL: /content/dist/rhel/server/7/$releasever/$basearch/rhscl/1/containers

-bash-4.2# service rhsmcertd restart && sleep 120
Redirecting to /bin/systemctl restart  rhsmcertd.service
     
-bash-4.2# tail -f /var/log/rhsm/rhsm.log
2016-07-15 19:05:40,071 [DEBUG] rhsmcertd-worker:4514 @base_action_client.py:85 - running lib: <subscription_manager.installedproductslib.InstalledProductsActionInvoker object at 0x211bb50>
    2016-07-15 19:05:40,071 [INFO] rhsmcertd-worker:4514 @connection.py:830 - Connection built: host=subscription.rhn.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ verify=False
    2016-07-15 19:05:40,073 [DEBUG] rhsmcertd-worker:4514 @identity.py:131 - Loading consumer info from identity certificates.
    2016-07-15 19:05:40,073 [DEBUG] rhsmcertd-worker:4514 @cache.py:154 - Checking current system info against cache: /var/lib/rhsm/cache/installed_products.json
    2016-07-15 19:05:40,073 [DEBUG] rhsmcertd-worker:4514 @cache.py:171 - No changes.
    2016-07-15 19:05:40,074 [DEBUG] rhsmcertd-worker:4514 @base_action_client.py:85 - running lib: <subscription_manager.healinglib.HealingActionInvoker object at 0x21223d0>
    2016-07-15 19:05:40,076 [DEBUG] rhsmcertd-worker:4514 @plugins.py:569 - loaded plugin modules: [<module 'container_content' from '/usr/share/rhsm-plugins/container_content.pyc'>, <module 'ostree_content' from '/usr/share/rhsm-plugins/ostree_content.pyc'>]
    2016-07-15 19:05:40,076 [DEBUG] rhsmcertd-worker:4514 @plugins.py:570 - loaded plugins: {'container_content.ContainerContentPlugin': <container_content.ContainerContentPlugin object at 0x2193310>, 'ostree_content.OstreeContentPlugin': <ostree_content.OstreeContentPlugin object at 0x21938d0>}
    2016-07-15 19:05:40,077 [DEBUG] rhsmcertd-worker:4514 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:40,077 [DEBUG] rhsmcertd-worker:4514 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d
    2016-07-15 19:05:41,832 [DEBUG] rhsmcertd-worker:4514 @connection.py:602 - Response: status=200, requestUuid=66d88f87-4ba2-4118-b550-9515f89d2ad8
    2016-07-15 19:05:41,834 [DEBUG] rhsmcertd-worker:4514 @cache.py:154 - Checking current system info against cache: /var/lib/rhsm/cache/installed_products.json
    2016-07-15 19:05:41,834 [DEBUG] rhsmcertd-worker:4514 @cache.py:171 - No changes.
    2016-07-15 19:05:41,834 [DEBUG] rhsmcertd-worker:4514 @certdirectory.py:216 - Installed product IDs: ['69', '32060']
    2016-07-15 19:05:41,835 [DEBUG] rhsmcertd-worker:4514 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:41,835 [DEBUG] rhsmcertd-worker:4514 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/compliance
    2016-07-15 19:05:43,545 [DEBUG] rhsmcertd-worker:4514 @connection.py:602 - Response: status=200, requestUuid=93c698ee-06d7-4f9f-bc0a-be531e18d95b
    2016-07-15 19:05:43,547 [DEBUG] rhsmcertd-worker:4514 @cache.py:289 - Started thread to write cache: /var/lib/rhsm/cache/entitlement_status.json
    2016-07-15 19:05:43,560 [INFO] rhsmcertd-worker:4514 @cert_sorter.py:205 - Product status: valid_products=69 partial_products= expired_products= unentitled_producs=32060 future_products= valid_until=None
    2016-07-15 19:05:43,560 [DEBUG] rhsmcertd-worker:4514 @cert_sorter.py:207 - partial stacks: []
    2016-07-15 19:05:43,560 [DEBUG] rhsmcertd-worker:4514 @cache.py:154 - Checking current system info against cache: /var/lib/rhsm/cache/installed_products.json
    2016-07-15 19:05:43,562 [DEBUG] rhsmcertd-worker:4514 @cache.py:171 - No changes.
    2016-07-15 19:05:43,562 [DEBUG] rhsmcertd-worker:4514 @identity.py:131 - Loading consumer info from identity certificates.
    2016-07-15 19:05:43,562 [WARNING] rhsmcertd-worker:4514 @healinglib.py:97 - Found invalid entitlements for today: 2016-07-15 13:35:41.834444+00:00
    2016-07-15 19:05:43,563 [DEBUG] rhsmcertd-worker:4514 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:43,564 [DEBUG] rhsmcertd-worker:4514 @connection.py:573 - Making request: POST /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/entitlements?entitle_date=2016-07-15T13%3A35%3A41.834444%2B00%3A00
    2016-07-15 19:05:43,564 [DEBUG] rhsmcertd-worker:4514 @cache.py:110 - Wrote cache: /var/lib/rhsm/cache/entitlement_status.json
    2016-07-15 19:05:45,787 [DEBUG] rhsmcertd-worker:4514 @connection.py:602 - Response: status=200, requestUuid=c4a7da6e-6f40-40a2-a447-161f4e3ef04d
    2016-07-15 19:05:45,788 [INFO] rhsmcertd-worker:4514 @connection.py:830 - Connection built: host=subscription.rhn.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ verify=False
    2016-07-15 19:05:45,800 [DEBUG] rhsmcertd-worker:4514 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:45,800 [DEBUG] rhsmcertd-worker:4514 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/certificates/serials
    2016-07-15 19:05:47,794 [DEBUG] rhsmcertd-worker:4514 @connection.py:602 - Response: status=200, requestUuid=ea67ece7-77f2-417a-9aa9-fa488bd23ea3
    2016-07-15 19:05:47,794 [INFO] rhsmcertd-worker:4514 @entcertlib.py:131 - certs updated:
    Total updates: 0
    Found (local) serial# [7351137234201293365L]
    Expected (UEP) serial# [7351137234201293365]
    Added (new)
      <NONE>
    Deleted (rogue):
      <NONE>
    2016-07-15 19:05:47,795 [INFO] rhsmcertd-worker:4514 @healinglib.py:131 - Entitlement auto healing was checked and entitlements
    2016-07-15 19:05:47,795 [DEBUG] rhsmcertd-worker:4514 @healinglib.py:139 - Auto-heal check complete.
    2016-07-15 19:05:47,795 [DEBUG] rhsmcertd-worker:4514 @base_action_client.py:85 - running lib: <subscription_manager.entcertlib.EntCertActionInvoker object at 0x20db990>
    2016-07-15 19:05:47,807 [DEBUG] rhsmcertd-worker:4514 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:47,807 [DEBUG] rhsmcertd-worker:4514 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/certificates/serials
    2016-07-15 19:05:49,796 [DEBUG] rhsmcertd-worker:4514 @connection.py:602 - Response: status=200, requestUuid=be8612df-7101-4614-a4f6-c3ed9f4e9ac2
    2016-07-15 19:05:49,796 [INFO] rhsmcertd-worker:4514 @entcertlib.py:131 - certs updated:
    Total updates: 0
    Found (local) serial# [7351137234201293365L]
    Expected (UEP) serial# [7351137234201293365]
    Added (new)
      <NONE>
    Deleted (rogue):
      <NONE>
    2016-07-15 19:05:49,916 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.entcertlib.EntCertActionInvoker object at 0x2637990>
    2016-07-15 19:05:49,917 [INFO] rhsmcertd-worker:4516 @connection.py:830 - Connection built: host=subscription.rhn.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ verify=False
    2016-07-15 19:05:49,917 [DEBUG] rhsmcertd-worker:4516 @identity.py:131 - Loading consumer info from identity certificates.
    2016-07-15 19:05:49,930 [DEBUG] rhsmcertd-worker:4516 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:49,931 [DEBUG] rhsmcertd-worker:4516 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/certificates/serials
    2016-07-15 19:05:51,916 [DEBUG] rhsmcertd-worker:4516 @connection.py:602 - Response: status=200, requestUuid=5691e423-8e4e-4322-9be0-a86322c60510
    2016-07-15 19:05:51,917 [INFO] rhsmcertd-worker:4516 @entcertlib.py:131 - certs updated:
    Total updates: 0
    Found (local) serial# [7351137234201293365L]
    Expected (UEP) serial# [7351137234201293365]
    Added (new)
      <NONE>
    Deleted (rogue):
      <NONE>
    2016-07-15 19:05:51,917 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.identitycertlib.IdentityCertActionInvoker object at 0x267e5d0>
    2016-07-15 19:05:51,918 [DEBUG] rhsmcertd-worker:4516 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:05:51,918 [DEBUG] rhsmcertd-worker:4516 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d
    2016-07-15 19:06:20,396 [DEBUG] rhsmcertd-worker:4516 @connection.py:602 - Response: status=200, requestUuid=b7da184d-8946-424b-baa2-b62f380f379d
    2016-07-15 19:06:20,398 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.content_action_client.ContentActionClient object at 0x2677b50>
    2016-07-15 19:06:20,398 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.repolib.RepoActionInvoker object at 0x267e750>
    2016-07-15 19:06:20,402 [DEBUG] rhsmcertd-worker:4516 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:06:20,402 [DEBUG] rhsmcertd-worker:4516 @connection.py:573 - Making request: GET /subscription/
    2016-07-15 19:06:22,296 [DEBUG] rhsmcertd-worker:4516 @connection.py:602 - Response: status=200
    2016-07-15 19:06:22,297 [DEBUG] rhsmcertd-worker:4516 @connection.py:847 - Server supports the following resources: {'': '/', 'guestids': '/consumers/{consumer_uuid}/guestids', 'cdn': '/cdn', 'content_overrides': '/consumers/{consumer_uuid}/content_overrides', 'hypervisors': '/hypervisors', 'serials': '/serials', 'deleted_consumers': '/deleted_consumers', 'consumers': '/consumers', 'migrations': '/migrations', 'content': '/content', 'entitlements': '/entitlements', 'events': '/events', 'status': '/status', 'jobs': '/jobs', 'users': '/users', 'subscriptions': '/subscriptions', 'rules': '/rules', 'distributor_versions': '/distributor_versions', 'consumertypes': '/consumertypes', 'statistics/generate': '/statistics/generate', 'pools': '/pools', 'atom': '/atom', 'packages': '/consumers/{consumer_uuid}/packages', 'owners': '/owners', 'roles': '/roles', 'admin': '/admin', 'products': '/products', 'activation_keys': '/activation_keys', 'crl': '/crl'}
    2016-07-15 19:06:22,298 [DEBUG] rhsmcertd-worker:4516 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:06:22,298 [DEBUG] rhsmcertd-worker:4516 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/content_overrides
    2016-07-15 19:06:24,250 [DEBUG] rhsmcertd-worker:4516 @connection.py:602 - Response: status=200, requestUuid=0266be25-bd84-4146-abd0-3e5e9fc0a7cb
    2016-07-15 19:06:24,251 [DEBUG] rhsmcertd-worker:4516 @cache.py:289 - Started thread to write cache: /var/lib/rhsm/cache/content_overrides.json
    2016-07-15 19:06:24,251 [DEBUG] rhsmcertd-worker:4516 @cache.py:110 - Wrote cache: /var/lib/rhsm/cache/content_overrides.json
    2016-07-15 19:06:24,296 [DEBUG] rhsmcertd-worker:4516 @__init__.py:85 - Searching for content of type: yum
    2016-07-15 19:06:24,298 [DEBUG] rhsmcertd-worker:4516 @connection.py:525 - Loaded CA certificates from /etc/rhsm/ca/: redhat-uep.pem, candlepin-ca.pem, skallesh.pem, redhat-entitlement-authority.pem
    2016-07-15 19:06:24,299 [DEBUG] rhsmcertd-worker:4516 @connection.py:573 - Making request: GET /subscription/consumers/bc950eac-8535-428a-aacb-009191b1a06d/release
    2016-07-15 19:06:26,283 [DEBUG] rhsmcertd-worker:4516 @connection.py:602 - Response: status=200, requestUuid=1d70fbc6-087e-4f1c-804a-2c8962eeee56
    2016-07-15 19:06:26,284 [DEBUG] rhsmcertd-worker:4516 @cache.py:289 - Started thread to write cache: /var/lib/rhsm/cache/releasever.json
    2016-07-15 19:06:26,358 [DEBUG] rhsmcertd-worker:4516 @cache.py:110 - Wrote cache: /var/lib/rhsm/cache/releasever.json
    2016-07-15 19:06:26,557 [DEBUG] rhsmcertd-worker:4516 @cache.py:110 - Wrote cache: /var/lib/rhsm/cache/written_overrides.json
    2016-07-15 19:06:26,558 [INFO] rhsmcertd-worker:4516 @repolib.py:303 - repos updated: Repo updates
     
    Total repo updates: 143
    Updated
        [id:rhel-7-server-satellite-tools-6.2-rpms Red Hat Satellite Tools 6.2 (for RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-v2vwin-1-debug-rpms Red Hat Virt V2V Tool for RHEL 7 (Debug RPMs)]
        [id:rhel-7-server-ose-3.0-source-rpms Red Hat OpenShift Enterprise 3.0 (Source RPMs)]
        [id:jws-3-for-rhel-6-server-debug-rpms JBoss Web Server 3 (RHEL 6 Server) (Debug RPMs)]
        [id:rhel-7-server-satellite-tools-6.1-debug-rpms Red Hat Satellite Tools 6.1 (for RHEL 7 Server) (Debug RPMs)]
        [id:rhel-server-rhscl-7-eus-source-rpms Red Hat Software Collections Source RPMs for Red Hat Enterprise Linux 7 RHEL 7 Server EUS]
        [id:rhel-7-server-ose-3.0-rpms Red Hat OpenShift Enterprise 3.0 (RPMs)]
        [id:rhel-7-server-rhceph-2-tools-rpms Red Hat Ceph Storage Tools 2 for Red Hat Enterprise Linux 7 Server (RPMs)]
        [id:rhel-7-server-extras-rpms Red Hat Enterprise Linux 7 Server - Extras (RPMs)]
        [id:rhel-7-server-satellite-tools-6.1-source-rpms Red Hat Satellite Tools 6.1 (for RHEL 7 Server) (Source RPMs)]
        [id:jb-eap-7-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 7 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-rhn-tools-beta-rpms RHN Tools for Red Hat Enterprise Linux 7 Server Beta (RPMs)]
        [id:rhel-7-server-supplementary-debug-rpms Red Hat Enterprise Linux 7 Server - Supplementary (Debug RPMs)]
        [id:cf-me-for-rhel-7-beta-rpms Red Hat CloudForms Beta (RPMs)]
        [id:rhel-7-server-ose-3.2-rpms Red Hat OpenShift Enterprise 3.2 (RPMs)]
        [id:rhel-server-rhscl-7-beta-source-rpms Red Hat Software Collections Beta Source RPMs for Red Hat Enterprise Linux 7 Server]
        [id:rhel-7-server-openstack-7.0-tools-rpms Red Hat OpenStack Tools 7.0 for Red Hat Enterprise Linux 7 Server (RPMs)]
        [id:rhel-7-server-rhceph-1.3-tools-source-rpms Red Hat Ceph Storage Tools 1.3 for Red Hat Enterprise Linux 7 Server (Source RPMs)]
        [id:rhel-7-server-optional-beta-debug-rpms Red Hat Enterprise Linux 7 Server - Optional Beta (Debug RPMs)]
        [id:rhel-7-server-openstack-7.0-tools-debug-rpms Red Hat OpenStack Tools 7.0 for Red Hat Enterprise Linux 7 Server (Debug RPMs)]
        [id:rh-gluster-3-client-for-rhel-7-server-debug-rpms Red Hat Storage Native Client for RHEL 7 (Debug RPMs)]
        [id:rhel-7-server-optional-fastrack-debug-rpms Red Hat Enterprise Linux 7 Server - Optional Fastrack (Debug RPMs)]
        [id:rhel-7-server-satellite-tools-6.2-source-rpms Red Hat Satellite Tools 6.2 (for RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-openstack-9-tools-rpms Red Hat OpenStack Platform 9 Tools for RHEL 7 Server (RPMs)]
        [id:rhel-atomic-host-debug-rpms Red Hat Enterprise Linux Atomic Host (Debug RPMs)]
        [id:rhel-7-server-ose-3.0-debug-rpms Red Hat OpenShift Enterprise 3.0 (Debug RPMs)]
        [id:cf-me-for-rhel-7-beta-source-rpms Red Hat CloudForms Beta (Source RPMs)]
        [id:rhel-7-server-satellite-tools-6.2-debug-rpms Red Hat Satellite Tools 6.2 (for RHEL 7 Server) (Debug RPMs)]
        [id:jws-3-for-rhel-7-server-rpms JBoss Web Server 3 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-supplementary-beta-source-rpms Red Hat Enterprise Linux 7 Server - Supplementary Beta (Source RPMs)]
        [id:cf-me-5.5-for-rhel-7-rpms Red Hat CloudForms Management Engine 5.5 (RPMs)]
        [id:rhel-7-server-openstack-10-tools-debug-rpms Red Hat OpenStack Platform 10 Tools for RHEL 7 Server (Debug RPMs)]
        [id:rhel-7-server-thirdparty-oracle-java-source-rpms Red Hat Enterprise Linux 7 Server - Oracle Java (Source RPMs)]
        [id:jb-ews-2-for-rhel-7-server-debug-rpms JBoss Enterprise Web Server 2 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-openstack-9-tools-source-rpms Red Hat OpenStack Platform 9 Tools for RHEL 7 Server (Source RPMs)]
        [id:rhel-7-server-thirdparty-oracle-java-beta-source-rpms Red Hat Enterprise Linux 7 Server - Oracle Java Beta (Source RPMs)]
        [id:rhel-7-server-openstack-10-tools-source-rpms Red Hat OpenStack Platform 10 Tools for RHEL 7 Server (Source RPMs)]
        [id:rhel-7-server-beta-rpms Red Hat Enterprise Linux 7 Server Beta (RPMs)]
        [id:rhel-7-server-optional-debug-rpms Red Hat Enterprise Linux 7 Server - Optional (Debug RPMs)]
        [id:cf-me-5.6-for-rhel-7-source-rpms Red Hat CloudForms Management Engine 5.6 (Source RPMs)]
        [id:jb-eap-6-for-rhel-7-server-rpms JBoss Enterprise Application Platform 6 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-rhceph-1.3-tools-debug-rpms Red Hat Ceph Storage Tools 1.3 for Red Hat Enterprise Linux 7 Server (Debug RPMs)]
        [id:rhel-7-server-openstack-10-tools-rpms Red Hat OpenStack Platform 10 Tools for RHEL 7 Server (RPMs)]
        [id:rhel-server-rhscl-7-eus-debug-rpms Red Hat Software Collections Debug RPMs for Red Hat Enterprise Linux 7 RHEL 7 Server EUS]
        [id:cf-me-5.6-for-rhel-7-debug-rpms Red Hat CloudForms Management Engine 5.6 (Debug RPMs)]
        [id:cf-me-5.5-for-rhel-7-debug-rpms Red Hat CloudForms Management Engine 5.5 (Debug RPMs)]
        [id:rhel-server-rhscl-7-rpms Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server]
        [id:a-mq-clients-1-for-rhel-7-server-beta-rpms JBoss A-MQ Clients 1 Early Access (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-rhn-tools-rpms RHN Tools for Red Hat Enterprise Linux 7 Server (RPMs)]
        [id:rhel-server-rhscl-7-beta-debug-rpms Red Hat Software Collections Beta Debug RPMs for Red Hat Enterprise Linux 7 Server]
        [id:a-mq-clients-1-for-rhel-7-server-beta-source-rpms JBoss A-MQ Clients 1 Early Access (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-optional-fastrack-source-rpms Red Hat Enterprise Linux 7 Server - Optional Fastrack (Source RPMs)]
        [id:rhel-7-server-thirdparty-oracle-java-rpms Red Hat Enterprise Linux 7 Server - Oracle Java (RPMs)]
        [id:rhel-7-server-fastrack-rpms Red Hat Enterprise Linux 7 Server - Fastrack (RPMs)]
        [id:rhel-7-server-ose-3.2-source-rpms Red Hat OpenShift Enterprise 3.2 (Source RPMs)]
        [id:rhel-7-server-ose-3.1-source-rpms Red Hat OpenShift Enterprise 3.1 (Source RPMs)]
        [id:rhel-7-server-thirdparty-oracle-java-beta-rpms Red Hat Enterprise Linux 7 Server - Oracle Java Beta (RPMs)]
        [id:rhel-7-server-optional-fastrack-rpms Red Hat Enterprise Linux 7 Server - Optional Fastrack (RPMs)]
        [id:jb-eap-6-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 6 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-atomic-host-rpms Red Hat Enterprise Linux Atomic Host (RPMs)]
        [id:rhel-7-server-insights-client-1-debug-rpms Red Hat Insights Client 1 (for RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-rhn-tools-beta-source-rpms RHN Tools for Red Hat Enterprise Linux 7 Server Beta (Source RPMs)]
        [id:a-mq-clients-1-for-rhel-7-server-rpms JBoss A-MQ Clients 1 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-extras-source-rpms Red Hat Enterprise Linux 7 Server - Extras (Source RPMs)]
        [id:jb-eap-6.4-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 6.4 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-atomic-host-source-rpms Red Hat Enterprise Linux Atomic Host (Source RPMs)]
        [id:jb-eap-7.1-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 7.1 (RHEL 7 Server) (Debug RPMs)]
        [id:cf-me-5.6-for-rhel-7-rpms Red Hat CloudForms Management Engine 5.6 (RPMs)]
        [id:rhel-7-server-fastrack-debug-rpms Red Hat Enterprise Linux 7 Server - Fastrack (Debug RPMs)]
        [id:rhel-7-server-optional-beta-rpms Red Hat Enterprise Linux 7 Server - Optional Beta (RPMs)]
        [id:rhel-7-server-optional-source-rpms Red Hat Enterprise Linux 7 Server - Optional (Source RPMs)]
        [id:rhel-7-server-rhn-tools-beta-debug-rpms RHN Tools for Red Hat Enterprise Linux 7 Server Beta (Debug RPMs)]
        [id:rhel-server-rhscl-7-debug-rpms Red Hat Software Collections Debug RPMs for Red Hat Enterprise Linux 7 Server]
        [id:rhel-server-rhscl-7-beta-rpms Red Hat Software Collections Beta RPMs for Red Hat Enterprise Linux 7 Server]
        [id:rhel-7-server-beta-source-rpms Red Hat Enterprise Linux 7 Server Beta (Source RPMs)]
        [id:rhel-7-server-openstack-9-tools-debug-rpms Red Hat OpenStack Platform 9 Tools for RHEL 7 Server (Debug RPMs)]
        [id:jb-eap-6.4-for-rhel-7-server-rpms JBoss Enterprise Application Platform 6.4 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-satellite-tools-6-beta-source-rpms Red Hat Satellite Tools 6 Beta (for RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-v2vwin-1-rpms Red Hat Virt V2V Tool for RHEL 7 (RPMs)]
        [id:rhel-7-server-ose-3.1-rpms Red Hat OpenShift Enterprise 3.1 (RPMs)]
        [id:rhel-7-server-rhceph-2-tools-debug-rpms Red Hat Ceph Storage Tools 2 for Red Hat Enterprise Linux 7 Server (Debug RPMs)]
        [id:rhel-7-server-rh-common-beta-rpms Red Hat Enterprise Linux 7 Server - RH Common Beta (RPMs)]
        [id:cf-me-for-rhel-7-beta-debug-rpms Red Hat CloudForms Beta (Debug RPMs)]
        [id:jb-coreservices-1-for-rhel-7-server-rpms JBoss Core Services (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-extras-debug-rpms Red Hat Enterprise Linux 7 Server - Extras (Debug RPMs)]
        [id:rhel-7-server-debug-rpms Red Hat Enterprise Linux 7 Server (Debug RPMs)]
        [id:jb-eap-7-for-rhel-7-server-rpms JBoss Enterprise Application Platform 7 (RHEL 7 Server) (RPMs)]
        [id:rhel-server-rhscl-7-source-rpms Red Hat Software Collections Source RPMs for Red Hat Enterprise Linux 7 Server]
        [id:jb-ews-2-for-rhel-7-server-source-rpms JBoss Enterprise Web Server 2 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-insights-client-1-source-rpms Red Hat Insights Client 1 (for RHEL 7 Server) (Source RPMs)]
        [id:jws-3-for-rhel-7-server-source-rpms JBoss Web Server 3 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-rh-common-rpms Red Hat Enterprise Linux 7 Server - RH Common (RPMs)]
        [id:jb-eap-6.3-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 6.3 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-ose-3.1-debug-rpms Red Hat OpenShift Enterprise 3.1 (Debug RPMs)]
        [id:rhel-7-server-source-rpms Red Hat Enterprise Linux 7 Server (Source RPMs)]
        [id:rhel-7-server-satellite-tools-6.1-rpms Red Hat Satellite Tools 6.1 (for RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-rh-common-debug-rpms Red Hat Enterprise Linux 7 Server - RH Common (Debug RPMs)]
        [id:rhel-7-server-v2vwin-1-source-rpms Red Hat Virt V2V Tool for RHEL 7 (Source RPMs)]
        [id:jb-eap-6.3-for-rhel-7-server-rpms JBoss Enterprise Application Platform 6.3 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-rh-common-beta-source-rpms Red Hat Enterprise Linux 7 Server - RH Common Beta (Source RPMs)]
        [id:rhel-7-server-fastrack-source-rpms Red Hat Enterprise Linux 7 Server - Fastrack (Source RPMs)]
        [id:jb-eap-7.1-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 7.1 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-supplementary-beta-rpms Red Hat Enterprise Linux 7 Server - Supplementary Beta (RPMs)]
        [id:rhel-7-server-optional-beta-source-rpms Red Hat Enterprise Linux 7 Server - Optional Beta (Source RPMs)]
        [id:jb-eap-6.4-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 6.4 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-rh-common-source-rpms Red Hat Enterprise Linux 7 Server - RH Common (Source RPMs)]
        [id:jb-eap-7-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 7 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-rhceph-2-tools-source-rpms Red Hat Ceph Storage Tools 2 for Red Hat Enterprise Linux 7 Server (Source RPMs)]
        [id:jb-coreservices-1-for-rhel-7-server-debug-rpms JBoss Core Services (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-rhn-tools-debug-rpms RHN Tools for Red Hat Enterprise Linux 7 Server (Debug RPMs)]
        [id:jb-eap-6.3-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 6.3 (RHEL 7 Server) (Source RPMs)]
        [id:rh-gluster-3-client-for-rhel-7-server-rpms Red Hat Storage Native Client for RHEL 7 (RPMs)]
        [id:jb-eap-7.0-for-rhel-7-server-debug-rpms JBoss Enterprise Application Platform 7.0 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-rpms Red Hat Enterprise Linux 7 Server (RPMs)]
        [id:a-mq-clients-1-for-rhel-7-server-beta-debug-rpms JBoss A-MQ Clients 1 Early Access (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-openstack-8-tools-source-rpms Red Hat OpenStack Platform 8 Tools for RHEL 7 Server (Source RPMs)]
        [id:jb-eap-6-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 6 (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-supplementary-beta-debug-rpms Red Hat Enterprise Linux 7 Server - Supplementary Beta (Debug RPMs)]
        [id:rh-gluster-3-client-for-rhel-7-server-source-rpms Red Hat Storage Native Client for RHEL 7 (Source RPMs)]
        [id:jb-eap-7.0-for-rhel-7-server-rpms JBoss Enterprise Application Platform 7.0 (RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-rh-common-beta-debug-rpms Red Hat Enterprise Linux 7 Server - RH Common Beta (Debug RPMs)]
        [id:rhel-7-server-openstack-8-tools-rpms Red Hat OpenStack Platform 8 Tools for RHEL 7 Server (RPMs)]
        [id:rhel-7-server-rhceph-1.3-tools-rpms Red Hat Ceph Storage Tools 1.3 for Red Hat Enterprise Linux 7 Server (RPMs)]
        [id:jb-coreservices-1-for-rhel-7-server-source-rpms JBoss Core Services (RHEL 7 Server) (Source RPMs)]
        [id:rhel-7-server-satellite-tools-6-beta-debug-rpms Red Hat Satellite Tools 6 Beta (for RHEL 7 Server) (Debug RPMs)]
        [id:rhel-server-rhscl-7-eus-rpms Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 RHEL 7 Server EUS]
        [id:rhel-7-server-openstack-8-tools-debug-rpms Red Hat OpenStack Platform 8 Tools for RHEL 7 Server (Debug RPMs)]
        [id:jb-eap-7.0-for-rhel-7-server-source-rpms JBoss Enterprise Application Platform 7.0 (RHEL 7 Server) (Source RPMs)]
        [id:a-mq-clients-1-for-rhel-7-server-source-rpms JBoss A-MQ Clients 1 (RHEL 7 Server) (Source RPMs)]
        [id:a-mq-clients-1-for-rhel-7-server-debug-rpms JBoss A-MQ Clients 1 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-ose-3.2-debug-rpms Red Hat OpenShift Enterprise 3.2 (Debug RPMs)]
        [id:rhel-7-server-supplementary-rpms Red Hat Enterprise Linux 7 Server - Supplementary (RPMs)]
        [id:rhel-7-server-insights-client-1-rpms Red Hat Insights Client 1 (for RHEL 7 Server) (RPMs)]
        [id:rhel-7-server-optional-rpms Red Hat Enterprise Linux 7 Server - Optional (RPMs)]
        [id:rhel-7-server-satellite-tools-6-beta-rpms Red Hat Satellite Tools 6 Beta (for RHEL 7 Server) (RPMs)]
        [id:jb-ews-2-for-rhel-7-server-rpms JBoss Enterprise Web Server 2 (RHEL 7 Server) (RPMs)]
        [id:cf-me-5.5-for-rhel-7-source-rpms Red Hat CloudForms Management Engine 5.5 (Source RPMs)]
        [id:rhel-7-server-rhn-tools-source-rpms RHN Tools for Red Hat Enterprise Linux 7 Server (Source RPMs)]
        [id:jws-3-for-rhel-7-server-debug-rpms JBoss Web Server 3 (RHEL 7 Server) (Debug RPMs)]
        [id:rhel-7-server-supplementary-source-rpms Red Hat Enterprise Linux 7 Server - Supplementary (Source RPMs)]
        [id:rhel-7-server-beta-debug-rpms Red Hat Enterprise Linux 7 Server Beta (Debug RPMs)]
        [id:rhel-7-server-openstack-7.0-tools-source-rpms Red Hat OpenStack Tools 7.0 for Red Hat Enterprise Linux 7 Server (Source RPMs)]
        [id:jb-eap-7.1-for-rhel-7-server-rpms JBoss Enterprise Application Platform 7.1 (RHEL 7 Server) (RPMs)]
    Added (new)
        <NONE>
    Deleted
        <NONE>
    2016-07-15 19:06:26,561 [DEBUG] rhsmcertd-worker:4516 @plugins.py:569 - loaded plugin modules: [<module 'container_content' from '/usr/share/rhsm-plugins/container_content.pyc'>, <module 'ostree_content' from '/usr/share/rhsm-plugins/ostree_content.pyc'>]
    2016-07-15 19:06:26,561 [DEBUG] rhsmcertd-worker:4516 @plugins.py:570 - loaded plugins: {'container_content.ContainerContentPlugin': <container_content.ContainerContentPlugin object at 0x2817950>, 'ostree_content.OstreeContentPlugin': <ostree_content.OstreeContentPlugin object at 0x2817f90>}
    2016-07-15 19:06:26,563 [DEBUG] rhsmcertd-worker:4516 @plugins.py:769 - Running update_content_hook in container_content.ContainerContentPlugin
    2016-07-15 19:06:26,563 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.content_action_client.ContentPluginActionInvoker object at 0x2fe5390>
    2016-07-15 19:06:26,564 [INFO] rhsmcertd-worker:4516 @container_content.py:43 - Updating container content.
    2016-07-15 19:06:26,564 [INFO] rhsmcertd-worker:4516 @container_content.py:45 - registry hostnames = registry.access.redhat.com,cdn.redhat.com,access.redhat.com,registry.redhat.io
    2016-07-15 19:06:26,564 [DEBUG] rhsmcertd-worker:4516 @__init__.py:85 - Searching for content of type: containerimage
    2016-07-15 19:06:26,564 [DEBUG] rhsmcertd-worker:4516 @container.py:53 - Got content_sets: [<subscription_manager.model.ent_cert.EntitlementCertContent object at 0x2888d90>, <subscription_manager.model.ent_cert.EntitlementCertContent object at 0x2fe2b50>, <subscription_manager.model.ent_cert.EntitlementCertContent object at 0x2fe3950>, <subscription_manager.model.ent_cert.EntitlementCertContent object at 0x2fe4a90>]
    2016-07-15 19:06:26,564 [DEBUG] rhsmcertd-worker:4516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/registry.access.redhat.com
    2016-07-15 19:06:26,564 [DEBUG] rhsmcertd-worker:4516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/cdn.redhat.com
    2016-07-15 19:06:26,565 [DEBUG] rhsmcertd-worker:4516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/access.redhat.com
    2016-07-15 19:06:26,565 [DEBUG] rhsmcertd-worker:4516 @container.py:138 - Syncing container certificates to /etc/docker/certs.d/registry.redhat.io
    2016-07-15 19:06:26,565 [DEBUG] rhsmcertd-worker:4516 @plugins.py:769 - Running update_content_hook in ostree_content.OstreeContentPlugin
    2016-07-15 19:06:26,565 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.content_action_client.ContentPluginActionInvoker object at 0x2817d50>
    2016-07-15 19:06:26,565 [INFO] rhsmcertd-worker:4516 @ostree_content.py:34 - ostree update_content_hook plugin.
    2016-07-15 19:06:26,566 [DEBUG] rhsmcertd-worker:4516 @__init__.py:85 - Searching for content of type: ostree
    2016-07-15 19:06:26,566 [WARNING] rhsmcertd-worker:4516 @config.py:115 - /etc/ostree/remotes.d does not exist, so unable to save /etc/ostree/remotes.d/redhat.conf
    2016-07-15 19:06:26,716 [WARNING] rhsmcertd-worker:4516 @model.py:421 - OstreeGIWrapperError: Error looking up OSTree origin file. 'python /usr/lib/python2.7/site-packages/subscription_manager/plugin/ostree/gi_wrapper.py --deployed-origin' returned exist status: 1
    2016-07-15 19:06:26,717 [DEBUG] rhsmcertd-worker:4516 @action_invoker.py:90 - Ostree update report: Ostree repo updates
     
    Updates:
     
    Added:
     
    Deleted:
     
    2016-07-15 19:06:26,718 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.factlib.FactsActionInvoker object at 0x2677b90>
    2016-07-15 19:06:26,731 [DEBUG] rhsmcertd-worker:4516 @hwprobe.py:580 - cpu info: {'cpu.cpu(s)': 4, 'cpu.core(s)_per_socket': 4, 'cpu.thread(s)_per_core': 1, 'cpu.topology_source': 'kernel /sys cpu sibling lists', 'cpu.cpu_socket(s)': 1}
    2016-07-15 19:06:27,968 [DEBUG] rhsmcertd-worker:4516 @hwprobe.py:806 - Running 'virt-what'
    2016-07-15 19:06:27,991 [DEBUG] rhsmcertd-worker:4516 @hwprobe.py:810 - virt-what stdout:
    2016-07-15 19:06:27,991 [DEBUG] rhsmcertd-worker:4516 @hwprobe.py:811 - virt-what stderr:
    2016-07-15 19:06:28,008 [INFO] rhsmcertd-worker:4516 @hwprobe.py:916 - collected virt facts: virt.is_guest=False, virt.host_type=Not Applicable, virt.uuid=Not Set
    2016-07-15 19:06:28,009 [DEBUG] rhsmcertd-worker:4516 @factlib.py:105 - Facts have not changed, skipping upload.
    2016-07-15 19:06:28,009 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.packageprofilelib.PackageProfileActionInvoker object at 0x267e490>
    2016-07-15 19:06:28,009 [DEBUG] rhsmcertd-worker:4516 @cache.py:154 - Checking current system info against cache: /var/lib/rhsm/packages/packages.json
    2016-07-15 19:06:28,009 [DEBUG] rhsmcertd-worker:4516 @profile.py:84 - Loading RPM profile from file.
    2016-07-15 19:06:28,021 [DEBUG] rhsmcertd-worker:4516 @profile.py:97 - Loading current RPM profile.
    2016-07-15 19:06:28,630 [DEBUG] rhsmcertd-worker:4516 @cache.py:171 - No changes.
    2016-07-15 19:06:28,630 [DEBUG] rhsmcertd-worker:4516 @base_action_client.py:85 - running lib: <subscription_manager.installedproductslib.InstalledProductsActionInvoker object at 0x267e510>
    2016-07-15 19:06:28,631 [DEBUG] rhsmcertd-worker:4516 @cache.py:154 - Checking current system info against cache: /var/lib/rhsm/cache/installed_products.json
    2016-07-15 19:06:28,631 [DEBUG] rhsmcertd-worker:4516 @cache.py:171 - No changes.

Comment 20 errata-xmlrpc 2016-11-04 02:31:37 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html

Note You need to log in before you can comment on or make changes to this bug.