Red Hat Bugzilla – Bug 1532275
[Selinux issues] Selinux label did not applied on ODL DPDK environment
Last modified: 2018-10-18 03:20:24 EDT
Description of problem: Instance creation failed on ODL DPDK environment, ERROR dropped on permission denied: 2018-01-08 13:37:22.394 1 ERROR nova.virt.libvirt.driver [req-f0244bd6-a673-4e0c-966d-3805db298af4 5541818b067d4a5a9eebb1b7c71ee9c5 67447e05062e49b7905adc5f712661c1 - default default] [instance: d9d60e55-315f-4f1a-959d-cdb676e07864] Failed to start libvirt guest: libvirtError: internal error: qemu unexpectedly closed the monitor: 2018-01-08T13:37:22.366873Z qemu-kvm: -chardev socket,id=charnet0,path=/var/lib/vhost_sockets/vhu08255778-25,server: Failed to bind socket to /var/lib/vhost_sockets/vhu08255778-25: Permission denied audit log: lvrabec: type=AVC msg=audit(1515418668.339:414): avc: denied { write } for pid=45951 comm="qemu-kvm" name="vhost_sockets" dev="sda2" ino=562036864 scontext=system_u:system_r:svirt_t:s0:c2,c512 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir label before resotrecon: # ll -Zd /var/lib/vhost_sockets/ drwxr-xr-x. qemu qemu system_u:object_r:var_lib_t:s0 /var/lib/vhost_sockets/ After: # restorecon -Rv /var/lib/vhost_sockets/ restorecon reset /var/lib/vhost_sockets context system_u:object_r:var_lib_t:s0->system_u:object_r:virt_cache_t:s0 # ll -Zd /var/lib/vhost_sockets/ drwxr-xr-x. qemu qemu system_u:object_r:virt_cache_t:s0 /var/lib/vhost_sockets/ Version-Release number of selected component (if applicable): # rpm -q --all | grep selinux libselinux-python-2.5-11.el7.x86_64 container-selinux-2.33-1.git86f33cd.el7.noarch selinux-policy-3.13.1-166.el7_4.7.noarch openstack-selinux-0.8.11-1.el7ost.noarch libselinux-ruby-2.5-11.el7.x86_64 libselinux-2.5-11.el7.x86_64 selinux-policy-targeted-3.13.1-166.el7_4.7.noarch libselinux-utils-2.5-11.el7.x86_64 ceph-selinux-10.2.7-48.el7cp.x86_64 How reproducible: Always Steps to Reproduce: 1. Install ODL+DPDK environment 2. Boot an instance(Get ERROR) 3. restorecon for /var/lib/vhost_sockets/ 4. Boot an instance successfully Actual results: Instance boot with error state Expected results: Instance should successfully boot Additional info:
https://github.com/redhat-openstack/openstack-selinux/commit/c6158ceb8ff4175e346db8d7efa78148e57aab42
According to our records, this should be resolved by openstack-selinux-0.8.13-2.el7ost. This build is available now.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:2086