Bug 1450820
| Summary: | "Other Options" is missed in cockpit login screen. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Virtualization Manager | Reporter: | Wei Wang <weiwang> | ||||||
| Component: | ovirt-node-ng | Assignee: | Ryan Barry <rbarry> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | jianwu <jiawu> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | 4.1.0 | CC: | bugs, cshao, dfediuck, dperpeet, huzhao, jiawu, leiwang, mgoldboi, michal.skrivanek, pvolpe, qe-baseos-daemons, qiyuan, rbarry, stefw, weiwang, yaniwang, ycui | ||||||
| Target Milestone: | ovirt-4.1.4 | Keywords: | Rebase, Regression, TestOnly, ZStream | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | cockpit-141-3.el7 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2017-08-10 16:11:24 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | Node | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 1278875 [details]
log files
Are you sure this worked in 0506? The package diff is very small, and there is nothing related to cockpit (In reply to Ryan Barry from comment #2) > Are you sure this worked in 0506? The package diff is very small, and there > is nothing related to cockpit Ryan I am sure this works in 0506, we have tested this case with build 0506. This bug report has Keywords: Regression or TestBlocker. Since no regressions or test blockers are allowed between releases, it is also being identified as a blocker for this release. Please resolve ASAP. Hi, I have test this bug on redhat-virtualization-host-4.1-20170613.0 "Other Options" exists in cockpit login screen on 7.4 build, but a new issues occurs following the bug link https://bugzilla.redhat.com/show_bug.cgi?id=1461700 You need the cockpit-ssh binary. Distributed in the cockpit-dashboard package to enable this feature. Seems there is also an selinux issue. In our package we include this command.
chcon -t cockpit_ws_exec_t %{_libexecdir}/cockpit-ssh
see: https://bugzilla.redhat.com/show_bug.cgi?id=1381331
I don't know if your install setup changes selinux perms after the packages are installed or if %post instructions are ignored. But running the command above fixes it for me.
(In reply to Peter from comment #12) > Seems there is also an selinux issue. In our package we include this command. > > chcon -t cockpit_ws_exec_t %{_libexecdir}/cockpit-ssh > > see: https://bugzilla.redhat.com/show_bug.cgi?id=1381331 > > I don't know if your install setup changes selinux perms after the packages > are installed or if %post instructions are ignored. But running the command > above fixes it for me. Hi, Peter could you provide more details about how to resolve this issue, I have found it that "other options" now display on cockpit UI? jiawu thanks Not sure what more I can say. selinux needs to allow cockpit-ws to execute cockpit-ssh. We do this by running the command given above in the %post section of the rpm. So when cockpit-dashboard is installed the command gets run. I'm not sure why that wasn't run when you installed cockpit-dashboard in this system. There are several possibilities depending on how you went about building this vm. But in short you need to make sure that chcon -t cockpit_ws_exec_t /usr/libexec/cockpit-ssh is run and the resulting changes are not overridden by something else. Running chcon in %post is not reliable Brew/koji do not run with selinux enabled at all, which means that selinux commands done as part of %post on any layered image which includes docker will not actually have this command run. This includes RHV-H, but could also include any other layered image or appliance which includes cockpit. I'll submit a patch to work around this from RHV-H, but why is this not part of the policy for cockpit in general, with the appropriate label applied automatically? Note also that the current solution using %post breaks if the filesystem is relabeled for any reason (setfiles, autorelabel, restorecon) When is a fix to the policy expected to make it downstream? I agree this is not ideal, bug is https://bugzilla.redhat.com/show_bug.cgi?id=1381914. Not sure how else to proceed. The following in %post should work and "stick" as a better hack (which will survive relabeling) until it makes it into selinux-policy semanage fcontext -a /usr/libexec/cockpit-ssh -t cockpit_session_exec_t Followed by: restorecon /usr/libexec/cockpit-ssh Or any other way you wish to restore the appropriate context. setfiles or restorecon being better than chcon. Thanks, ryan I'll take that back upstream. But just to be clear I don't think doing that will solve the initial issue reported here. Actually, it would... Since we know that builds in koji/brew don't use selinux, RHVH fixes the contexts of files on new installations and installs. Also, since we know there's at least one other package which is inserting a module then running fixfiles in %post, we specifically handle arbitrary selinux commands (setfiles, fixfiles, restorecon, semodule) in the %post scripts of every package installed on the system. chcon doesn't work for two reasons: 1) We don't look for chcon. We could, but... 2) setfiles/restorecon operations outside of %post are handled in a different thread, which runs concurrent with the %post selinux scripts, which are expected to set policies correctly. If we sent a patch to also check for and run chcon, we'd be racing against the "setfiles" thread, which would reset it if it lost the race. That's good to know. I didn't know you had special %post processing. opened upstream: https://github.com/cockpit-project/cockpit/pull/7132. Thanks Peter! moving to RHVH for a workaround solution Moving this to RHVH removes visibility from when this fix makes it downstream. I'm also against working around this from the RHVH side. cockpit is the only package which is using chcon in post, and moving back to a single-threaded update to work around this issue runs the risk of reaching the engine timeout. Reproducing the chcon at the end of our update is also possible, but it's an extremely specific fix tied to one package out of >500 on the image, for a low-priority item. This will be TestOnly. Stef/Dominik/Peter -- any idea when this will make it into Extras? (In reply to Ryan Barry from comment #27) > > Stef/Dominik/Peter -- any idea when this will make it into Extras? This should be fixed in 7.3.6-1 Hi, I have test this bug on redhat-virtualization-host-4.1-20170714.0 (7.4) Version-Release number of selected component (if applicable): cockpit-ws-141-2.el7.x86_64 Test Result: "Other Options" exists in cockpit login screen and could work normally So, I think this bug is fixed on new build(7.4), I will change status into VERIFIED jiawu Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2464 |
Created attachment 1278874 [details] picture Description of problem: A user can login to the remote host from cockpit login screen from RHVH 4.1. In this release build, the function of "Other Options" is missed in cockpit login screen. Version-Release number of selected component (if applicable): redhat-virtualization-host-4.1-20170512.0 cockpit-ws-135-4.el7.x86_64 cockpit-dashboard-135-4.el7.x86_64 cockpit-ovirt-dashboard-0.10.7-0.0.18.el7ev.noarch imgbased-0.9.25-0.1.el7ev.noarch How reproducible: 100% Steps to Reproduce: 1. Clean install redhat-virtualization-host-4.1-20170512.0 2. Launch cockpit login screen with "https://<host IP:9090>" Actual results: "Other Options" is missed in cockpit login screen. Expected results: "Other Options" should be existed in cockpit login screen. Additional info: "Other Options" is existed in cockpit login screen with redhat-virtualization-host-4.1-20170506.0.