RDO tickets are now tracked in Jira https://issues.redhat.com/projects/RDO/issues/
Bug 1362609 - glance-registry AVC name_connect when using memcached
Summary: glance-registry AVC name_connect when using memcached
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: RDO
Classification: Community
Component: openstack-selinux
Version: trunk
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: trunk
Assignee: Ryan Hallisey
QA Contact: Ofer Blaut
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-02 15:46 UTC by David Moreau Simard
Modified: 2017-02-17 15:40 UTC (History)
2 users (show)

Fixed In Version: openstack-selinux-0.7.5-1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-17 15:40:18 UTC
Embargoed:

Attachments (Terms of Use)

Description David Moreau Simard 2016-08-02 15:46:21 UTC 
In audit.log:
type=AVC msg=audit(1469800130.190:99833): avc:  denied  { name_connect } for  pid=17120 comm="glance-registry" dest=11211 scontext=system_u:system_r:glance_registry_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket

This can be reproduced with the parameter:
[keystone_authtoken]
memcached_servers = 127.0.0.1:11211

in glance-registry.conf

Reproduced the issue on Mitaka with:
# rpm -qa |egrep "openstack-selinux|glance|memcached"
openstack-glance-12.0.0-1.el7.noarch
python-glance-12.0.0-1.el7.noarch
python-glanceclient-2.0.0-1.el7.noarch
memcached-1.4.25-1.el7.x86_64
python-memcached-1.54-3.el7.noarch
python-glance-store-0.13.1-1.el7.noarch
openstack-selinux-0.7.2-1.el7.noarch
Comment 1 Lon Hohberger 2017-02-17 15:40:18 UTC 
# Bugzilla 1362609
corenet_tcp_connect_memcache_port(glance_registry_t)
Note You need to log in before you can comment on or make changes to this bug.