Bug 1498797
| Summary: | ovsdb-server fails to start with OVS-2.8.1 with AVC denial | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Community] RDO | Reporter: | Alfredo Moralejo <amoralej> | ||||
| Component: | openstack-selinux | Assignee: | Lon Hohberger <lhh> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Ofer Blaut <oblaut> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | trunk | CC: | apevec, srevivo | ||||
| Target Milestone: | --- | ||||||
| Target Release: | trunk | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1500122 (view as bug list) | Environment: | |||||
| Last Closed: | 2018-03-15 21:00:13 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1500122 | ||||||
| Attachments: |
|
||||||
|
Description
Alfredo Moralejo
2017-10-05 09:37:41 UTC
This can be reproduced on Fedora 27 with: selinux-policy-3.13.1-283.5.fc27.noarch openvswitch-2.8.1-1.fc27.x86_64 List of AVCs w/ SELinux permissive is below [*] NB this is just service start, there might be more in actual operation! This needs to be pushed first to https://github.com/fedora-selinux/selinux-policy then backported to openstack-selinux. [*] type=AVC msg=audit(1507594742.843:184): avc: denied { create } for pid=1424 comm="runuser" scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket permissive=1 type=AVC msg=audit(1507594742.843:185): avc: denied { nlmsg_relay } for pid=1424 comm="runuser" scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket permissive=1 type=AVC msg=audit(1507594742.844:186): avc: denied { audit_write } for pid=1424 comm="runuser" capability=29 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability permissive=1 type=AVC msg=audit(1507594743.049:195): avc: denied { dac_override } for pid=1431 comm="ovs-vsctl" capability=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability permissive=1 Created attachment 1336797 [details]
audit.log from permissive stop/start
#============= openvswitch_t ==============
allow openvswitch_t self:capability audit_write;
allow openvswitch_t self:netlink_audit_socket { create nlmsg_relay };
These are simple enough and consistent with the workings of openvswitch
ovsdb-server is still failing to start after https://github.com/redhat-openstack/openstack-selinux/commit/c677012699d2bad1846ab2a927b2af89ed976dcf I could start it after adding following policies: #============= openvswitch_t ============== allow openvswitch_t self:capability dac_override; allow openvswitch_t self:netlink_audit_socket { read write }; Note that some of the AVC issues only appear after i disabled dontaudit (semodule -DB) The messages i found in audit.log after disabling dontaudit:
type=AVC msg=audit(1507882760.767:1386): avc: denied { write } for pid=6246 comm="runuser" scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket
type=AVC msg=audit(1507882834.017:1434): avc: denied { read } for pid=6495 comm="runuser" scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_audit_socket
type=AVC msg=audit(1507882927.297:1507): avc: denied { dac_override } for pid=6744 comm="ovs-vsctl" capability=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability
Thanks! It's working fine in my test environment after https://github.com/redhat-openstack/openstack-selinux/commit/9d30e36cea34027f6e4cda7fb190c2c989223f18 |