Bug 1601152
| Summary: | openvswitch fails to start on nova compute nodes due to selinux failure | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Lars Kellogg-Stedman <lars> |
| Component: | openvswitch | Assignee: | Terry Wilson <twilson> |
| Status: | CLOSED DUPLICATE | QA Contact: | Ofer Blaut <oblaut> |
| Severity: | urgent | Docs Contact: | |
| Priority: | medium | ||
| Version: | 13.0 (Queens) | CC: | amuller, apevec, chrisw, lars, rhos-maint, srevivo, twilson |
| Target Milestone: | zstream | Keywords: | Reopened, Triaged, ZStream |
| Target Release: | 13.0 (Queens) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-09 15:29:23 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
NB: This environment is installed on pre-provisioned servers. *** This bug has been marked as a duplicate of bug 1642591 *** This is *not* a dupe of #1642591. This bug is "openvswitch is not configured to start at boot". Bug #1642591 is "openvswitch *fails* to start because of selinux". Does that clear things up? Whoops, never mind, I got confused about which openvswitch bug I was looking at. *** This bug has been marked as a duplicate of bug 1642591 *** |
Description of problem: The neutron_ovs_agent container on an OSP 13 compute node shows: # docker logs neutron_ovs_agent [...] Exception: Could not retrieve schema from tcp:127.0.0.1:6640: Connection refused Port 6640 is openvswitch. Looking at the system journal, we see: ovs-ctl[183442]: Starting ovsdb-server ovsdb-server: /var/run/openvswitch/ovsdb-server.pid.tmp: create failed (Permission denied) This failure is apparently due to: type=AVC msg=audit(1531565996.461:1047): avc: denied { write } for pid=183481 comm="ovsdb-server" name="openvswitch" dev="tmpfs" ino=48861 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:container_var_run_t:s0 tclass=dir Version-Release number of selected component (if applicable): openvswitch-2.9.0-19.el7fdp.1.x86_64 openstack-selinux-0.8.14-12.el7ost.noarch container-selinux-2.66-1.el7.noarch selinux-policy-targeted-3.13.1-192.el7_5.4.noarch