Red Hat Bugzilla – Bug 1390974
redis resource agent needs to fix up selinux permissions of rundir
Last modified: 2017-08-01 10:55:11 EDT
Description of problem: Via https://bugs.launchpad.net/bugs/1637961 we found out that redis would not start due to selinux: type=AVC msg=audit(1477956868.065:23265): avc: denied { write } for pid=11970 comm="redis-server" name="redis" dev="tmpfs" ino=130656 scontext=system_u:system_r:redis_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir The reason for this is that the rundir folder had the wrong permissions. We need the following pull request merged to fix this: https://github.com/ClusterLabs/resource-agents/pull/872
Verified: [root@overcloud-controller-1 ~]# rpm -qa | grep resource-agent resource-agents-3.9.5-83.el7.x86_64 [root@overcloud-controller-1 ~]# ls -dZ /var/run/redis/ drwxr-xr-x. redis redis system_u:object_r:redis_var_run_t:s0 /var/run/redis/ /var/log/redis/redis.log: 675228:M 02 Jan 05:18:34.530 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. 675228:M 02 Jan 05:18:34.530 # Server started, Redis version 3.0.6 675228:M 02 Jan 05:18:34.530 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. 675228:M 02 Jan 05:18:34.530 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled. 675228:M 02 Jan 05:18:34.531 * DB loaded from disk: 0.000 seconds 675228:M 02 Jan 05:18:34.531 * The server is now ready to accept connections on port 6379 675228:M 02 Jan 05:18:34.531 * The server is now ready to accept connections at /var/run/redis/redis.sock 675228:S 02 Jan 05:18:35.037 * SLAVE OF no-such-master:6379 enabled (user request from 'id=4 addr=/var/run/redis/redis.sock:0 fd=6 name= age=0 idle=0 flags=U db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=slaveof') 675228:S 02 Jan 05:18:35.788 * Connecting to MASTER no-such-master:6379 675228:S 02 Jan 05:18:35.791 # Unable to connect to MASTER: Resource temporarily unavailable .. output ommited # ahirshbe .. output ommited # ahirshbe 675228:S 02 Jan 05:19:17.938 # Unable to connect to MASTER: Resource temporarily unavailable 675228:M 02 Jan 05:19:18.000 * MASTER MODE enabled (user request from 'id=60 addr=/var/run/redis/redis.sock:0 fd=48 name= age=0 idle=0 flags=U db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=slaveof') 675228:M 02 Jan 05:19:18.818 * Slave 10.35.174.23:6379 asks for synchronization 675228:M 02 Jan 05:19:18.819 * Full resync requested by slave 10.35.174.23:6379 675228:M 02 Jan 05:19:18.819 * Starting BGSAVE for SYNC with target: disk 675228:M 02 Jan 05:19:18.820 * Background saving started by pid 680814 680814:C 02 Jan 05:19:18.841 * DB saved on disk 680814:C 02 Jan 05:19:18.842 * RDB: 2 MB of memory used by copy-on-write 675228:M 02 Jan 05:19:18.940 * Background saving terminated with success 675228:M 02 Jan 05:19:18.940 * Synchronization with slave 10.35.174.23:6379 succeeded 675228:M 02 Jan 05:19:19.039 * Slave 10.35.174.15:6379 asks for synchronization 675228:M 02 Jan 05:19:19.039 * Full resync requested by slave 10.35.174.15:6379 675228:M 02 Jan 05:19:19.039 * Starting BGSAVE for SYNC with target: disk 675228:M 02 Jan 05:19:19.040 * Background saving started by pid 680815 680815:C 02 Jan 05:19:19.057 * DB saved on disk 680815:C 02 Jan 05:19:19.058 * RDB: 2 MB of memory used by copy-on-write 675228:M 02 Jan 05:19:19.140 * Background saving terminated with success 675228:M 02 Jan 05:19:19.140 * Synchronization with slave 10.35.174.15:6379 succeeded
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1844