Red Hat Bugzilla – Bug 1482682
Open vSwitch selinux policy needs updating
Last modified: 2018-04-19 15:25:01 EDT
Description of problem: Open vSwitch 2.8.0 will require a new policy in order to have selinux enabled, since it now runs as a non-root user. The policy to be applied can be found at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-August/337516.html In that file, the content between @begin_dpdk@ and @end_dpdk@ needs to be kept (but the lines that contain @begin_dpdk@ and @end_dpdk@ should be cut).
also note that bz #1482682 also will want this change.
Oops, I meant to write bz #1442372
Following SELinux denial appeared several times in enforcing mode: ---- type=PROCTITLE msg=audit(08/18/2017 04:28:38.630:302) : proctitle=runuser --user openvswitch -- ovsdb-tool -vconsole:off create /etc/openvswitch/conf.db /usr/share/openvswitch/vswitch.ovsschema type=SYSCALL msg=audit(08/18/2017 04:28:38.630:302) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=netlink a1=SOCK_RAW a2=igp a3=0x7fff58dcffb0 items=0 ppid=31679 pid=31718 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=runuser exe=/usr/sbin/runuser subj=system_u:system_r:openvswitch_t:s0 key=(null) type=AVC msg=audit(08/18/2017 04:28:38.630:302) : avc: denied { create } for pid=31718 comm=runuser scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket ----
Following SELinux denials appeared in permissive mode: ---- type=PROCTITLE msg=audit(08/18/2017 04:33:00.080:313) : proctitle=runuser --user openvswitch -- ovsdb-tool -vconsole:off schema-version /usr/share/openvswitch/vswitch.ovsschema type=SYSCALL msg=audit(08/18/2017 04:33:00.080:313) : arch=x86_64 syscall=socket success=yes exit=3 a0=netlink a1=SOCK_RAW a2=igp a3=0x7ffe4fc24ec0 items=0 ppid=20283 pid=20284 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=runuser exe=/usr/sbin/runuser subj=system_u:system_r:openvswitch_t:s0 key=(null) type=AVC msg=audit(08/18/2017 04:33:00.080:313) : avc: denied { create } for pid=20284 comm=runuser scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket ---- type=PROCTITLE msg=audit(08/18/2017 04:33:00.080:314) : proctitle=runuser --user openvswitch -- ovsdb-tool -vconsole:off schema-version /usr/share/openvswitch/vswitch.ovsschema type=SYSCALL msg=audit(08/18/2017 04:33:00.080:314) : arch=x86_64 syscall=sendto success=yes exit=136 a0=0x3 a1=0x7ffe4fc1e660 a2=0x88 a3=0x0 items=0 ppid=20283 pid=20284 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=runuser exe=/usr/sbin/runuser subj=system_u:system_r:openvswitch_t:s0 key=(null) type=AVC msg=audit(08/18/2017 04:33:00.080:314) : avc: denied { audit_write } for pid=20284 comm=runuser capability=audit_write scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability type=AVC msg=audit(08/18/2017 04:33:00.080:314) : avc: denied { nlmsg_relay } for pid=20284 comm=runuser scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket ----
---- type=PROCTITLE msg=audit(08/18/2017 04:46:23.876:383) : proctitle=/bin/sh /usr/s hare/openvswitch/scripts/ovs-ctl --no-ovs-vswitchd stop type=SYSCALL msg=audit(08/18/2017 04:46:23.876:383) : arch=x86_64 syscall=kill s uccess=no exit=EPERM(Operation not permitted) a0=0x51f2 a1=SIGKILL a2=0x0 a3=0x5 1f2 items=0 ppid=1 pid=31461 auid=unset uid=root gid=root euid=root suid=root fs uid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ovs-ctl exe=/u sr/bin/bash subj=system_u:system_r:openvswitch_t:s0 key=(null) type=AVC msg=audit(08/18/2017 04:46:23.876:383) : avc: denied { kill } for pi d=31461 comm=ovs-ctl capability=kill scontext=system_u:system_r:openvswitch_t:s 0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability ---- I can't reproduce the other AVCs mentioned in https://mail.openvswitch.org/pipermail/ovs-dev/2017-August/337516.html but that's expected because I'm not familiar with openvswitch and DPDK.
Arie, one thing you could try is making sure that this line in /etc/sysconfig/openvswitch: OVS_USER_ID="openvswitch:openvswitch" is removed, so that it runs as root and probably won't be selinux issues anymore.
Would be better to set selinux enforcement mode to Permissive and then the selinux "problems" will be allowed, but the various errors will still be logged.
oops, commented on the wrong bug. in bz 1480897, they are setting to permissive, but director is somehow setting it back to enforcing in the process. so services start, but then fail to function. I meant to suggest in the *other* bug that if he needed to move past this known issue for CI, he could just make that change and change it back when this issue is resolved.
*** Bug 1503820 has been marked as a duplicate of this bug. ***
*** Bug 1541926 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763
*** Bug 1566373 has been marked as a duplicate of this bug. ***