In BZ#1766161, the following was reported (2019-10-29 15:13:10,455 root ERROR NM main-loop aborted: Connection update failed: error=nm-settings-error-quark: failed to update connection: Could not open file '/etc/sysconfig/network-scripts/ifcfg-ens3' for writing: Permission denied (3), dev=ens3/<enum NM_DEVICE_STATE_ACTIVATED of type NM.DeviceState>) Additional investigation via Slack found: ``` type=AVC msg=audit(1572361975.953:149): avc: denied { write } for pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0 type=AVC msg=audit(1572361983.181:151): avc: denied { write } for pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0 type=AVC msg=audit(1572361990.452:152): avc: denied { write } for pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0 ``` We need to relabel the ifcfg files that get persisted as part of ignition-dracut
The fix should be present in `ignition-0.33.0-9.rhaos4.3.git3625532.el8` and RHCOS builds after `43.81.201911011508.0`
Verified on 4.3.0-0.nightly-2019-11-19-122017 $ oc debug node/ip-10-0-129-117.ec2.internal Starting pod/ip-10-0-129-117ec2internal-debug ... To use host binaries, run `chroot /host` chroot /host If you don't see a command prompt, try pressing enter. chroot /host # ls -alZ /etc/sysconfig/network-scripts total 4 drwxr-xr-x. 2 root root system_u:object_r:net_conf_t:s0 6 Nov 20 16:18 . drwxr-xr-x. 3 root root system_u:object_r:etc_t:s0 4096 Nov 20 16:18 .. # rpm -q ignition ignition-0.33.0-13.rhaos4.3.git3625532.el8.x86_64 sh-4.4# exit exit sh-4.2# exit exit Removing debug pod ...
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0062