Red Hat Bugzilla – Bug 1486638
keepalived 1.3.5 requires setpgid permission
Last modified: 2018-04-10 08:42:56 EDT
Description of problem: In RHEL 7.4, keepalived was rebased to version 1.3.5. After upgrade from RHEL 7.3 with keepalived-1.2.13-9, avc denials started to appear. Version-Release number of selected component (if applicable): keepalived-1.3.5-1.el7.x86_64 selinux-policy-3.13.1-166.el7.noarch How reproducible: always Steps to Reproduce: 1. Upgrade to keepalived-1.3.5-1.el7 2. Run keepalived Actual results: type=AVC msg=audit(1504016429.630:5751): avc: denied { setpgid } for pid=10662 comm="keepalived" scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:system_r:keepalived_t:s0 tclass=process Expected results: no avc denial Additional info: downgrading keepalived to 1.2.13-9 makes the software working again custom policy based on the avc helps as well See also: OSP11 -undercloud on RHEL 7.4: avc: denied { setpgid } for pid=26143 https://bugzilla.redhat.com/show_bug.cgi?id=1469823 keepalived: Rebase to latest stable release https://bugzilla.redhat.com/show_bug.cgi?id=1419049
So when can we expect the new selinux-policy package to be available in the repository?
The 7.4.z Errata shall be released in matter of days if everything goes well.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763