Bug 1628371 - [3.9] Fluentd pods failed to start after an update to 3.9.41 when deny_execmem=1 on nodes
Summary: [3.9] Fluentd pods failed to start after an update to 3.9.41 when deny_execme...
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.9.0
Hardware: All
OS: Linux
unspecified
urgent
Target Milestone: ---
: 3.9.z
Assignee: Rich Megginson
QA Contact: Anping Li
URL:
Whiteboard:
Keywords: NeedsTestCase
Depends On:
Blocks: 1628405 1628407
TreeView+ depends on / blocked
 
Reported: 2018-09-12 20:34 UTC by Franck Grosjean
Modified: 2019-07-09 07:50 UTC (History)
4 users (show)

(edit)
Cause: rubygem ffi 1.9.25 reverted a patch which allowed it to work on systems with SELinux deny_execmem=1.

Consequence: Fluentd crashes.

Fix: The fix is to revert the patch reversion.

Result: Fluentd does not crash when using SELinux deny_execmem=1.
Clone Of:
: 1628405 1655691 (view as bug list)
(edit)
Last Closed: 2018-11-20 03:12:03 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2908 None None None 2018-11-20 03:12 UTC

Description Franck Grosjean 2018-09-12 20:34:40 UTC
Description of problem:
Fluentd pods failed to start after an update to 3.9.41
It was working fine before that (OCP upgrade from 3.9.33 to 3.9.41)

Version-Release number of selected component (if applicable):
3.9.41

How reproducible:
Upgarde fluentd from 3.9.33 to 3.9.41

Actual results:
All fluentd pods crash

Expected results:
All fluentd pods should start

Additional info:
Pods failed to start when setsebool -P deny_execmem 1 on nodes
looks like a regression since https://bugzilla.redhat.com/show_bug.cgi?id=1465039

Comment 13 Anping Li 2018-10-12 10:20:11 UTC
Verified and pass with logging-fluentd/images/v3.9.45-1

Comment 19 errata-xmlrpc 2018-11-20 03:12:03 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2908


Note You need to log in before you can comment on or make changes to this bug.