Description of problem: After minor update (rhel 7.5 to 7.6) instance actions fail and neutron networking is broken New instance spawn fails Start instance fails Live-migration fails Version-Release number of selected component (if applicable): How reproducible: minor update (rhel 7.5 to 7.6) Steps to Reproduce: 1. 2. 3. Actual results: instance actions fail and neutron networking is broken Expected results: Not fail Additional info:
Setting setenforce 0 on controllers and then restart neutron services on controllers and restart rabbit, then setenforce 0 on the computes and restart neutron and openstack services things get a little better. e.g. We no longer see the neutron errors in /var/log/secure. BUT instance actions like nova start continue to fail
This looks similar to the nova rootwrap issues that should have been resolved in openstack-selinux-0.8.15-1.el7ost / selinux-policy-3.13.1-229.el7_6.6 (bug 1645270 / bug 1638547) and are both installed on the system. The current AVC denials only relate to neutron_t so it's possible the same generic fix for pam authentication may work, though I am not sure specifically about pam_lsass. I will propose a patch.
https://github.com/redhat-openstack/openstack-selinux/pull/27
Merged upstream. Simple workaround for pbis users.
The workaround mentioned above as well as the optional pbis boolean added in for bug 1658815 are available in the latest build. Based on the discussions in the other bug, this should help with the AVCs mentioned here as well.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0922