Bug 1532275 - [Selinux issues] Selinux label did not applied on ODL DPDK environment
Summary: [Selinux issues] Selinux label did not applied on ODL DPDK environment
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-selinux
Version: 12.0 (Pike)
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: beta
: 13.0 (Queens)
Assignee: Lon Hohberger
QA Contact: Maxim Babushkin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-08 14:42 UTC by Eyal Dannon
Modified: 2018-10-18 07:20 UTC (History)
17 users (show)

Fixed In Version: openstack-selinux-0.8.13-1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
N/A
Last Closed: 2018-06-27 13:41:30 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:2086 None None None 2018-06-27 13:42:00 UTC

Description Eyal Dannon 2018-01-08 14:42:24 UTC
Description of problem:
Instance creation failed on ODL DPDK environment,

ERROR dropped on permission denied:

2018-01-08 13:37:22.394 1 ERROR nova.virt.libvirt.driver [req-f0244bd6-a673-4e0c-966d-3805db298af4 5541818b067d4a5a9eebb1b7c71ee9c5 67447e05062e49b7905adc5f712661c1 - default default] [instance: d9d60e55-315f-4f1a-959d-cdb676e07864] Failed to start libvirt guest: libvirtError: internal error: qemu unexpectedly closed the monitor: 2018-01-08T13:37:22.366873Z qemu-kvm: -chardev socket,id=charnet0,path=/var/lib/vhost_sockets/vhu08255778-25,server: Failed to bind socket to /var/lib/vhost_sockets/vhu08255778-25: Permission denied

audit log:
lvrabec: type=AVC msg=audit(1515418668.339:414): avc:  denied  { write } for  pid=45951 comm="qemu-kvm" name="vhost_sockets" dev="sda2" ino=562036864 scontext=system_u:system_r:svirt_t:s0:c2,c512 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir


label before resotrecon:
# ll -Zd /var/lib/vhost_sockets/
drwxr-xr-x. qemu qemu system_u:object_r:var_lib_t:s0   /var/lib/vhost_sockets/

After:
#  restorecon -Rv /var/lib/vhost_sockets/
restorecon reset /var/lib/vhost_sockets context system_u:object_r:var_lib_t:s0->system_u:object_r:virt_cache_t:s0

# ll -Zd /var/lib/vhost_sockets/
drwxr-xr-x. qemu qemu system_u:object_r:virt_cache_t:s0 /var/lib/vhost_sockets/



Version-Release number of selected component (if applicable):

# rpm -q --all | grep selinux
libselinux-python-2.5-11.el7.x86_64
container-selinux-2.33-1.git86f33cd.el7.noarch
selinux-policy-3.13.1-166.el7_4.7.noarch
openstack-selinux-0.8.11-1.el7ost.noarch
libselinux-ruby-2.5-11.el7.x86_64
libselinux-2.5-11.el7.x86_64
selinux-policy-targeted-3.13.1-166.el7_4.7.noarch
libselinux-utils-2.5-11.el7.x86_64
ceph-selinux-10.2.7-48.el7cp.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Install ODL+DPDK environment
2. Boot an instance(Get ERROR)
3. restorecon for /var/lib/vhost_sockets/
4. Boot an instance successfully  

Actual results:
Instance boot with error state

Expected results:
Instance should successfully boot

Additional info:

Comment 3 Lon Hohberger 2018-03-29 10:33:47 UTC
According to our records, this should be resolved by openstack-selinux-0.8.13-2.el7ost.  This build is available now.

Comment 8 errata-xmlrpc 2018-06-27 13:41:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2086


Note You need to log in before you can comment on or make changes to this bug.