Bug 1766739 - unable to write ifcfg file to /etc/sysconfig/network-scripts/ due to bad SELinux labeling
Summary: unable to write ifcfg file to /etc/sysconfig/network-scripts/ due to bad SELi...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: RHCOS
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 4.3.0
Assignee: Colin Walters
QA Contact: Michael Nguyen
URL:
Whiteboard:
Depends On:
Blocks: 1766740
TreeView+ depends on / blocked
 
Reported: 2019-10-29 18:53 UTC by Micah Abbott
Modified: 2020-01-23 11:10 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1766740 (view as bug list)
Environment:
Last Closed: 2020-01-23 11:09:46 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github coreos ignition-dracut pull 130 'None' closed [spec2x] persist-ifcfg: Ensure files we write have SELinux labels 2020-02-13 10:44:54 UTC
Github openshift installer pull 2609 'None' closed Bug 1766739: rhcos: Bump to 43.81.201911011153.0 2020-02-13 10:44:54 UTC
Red Hat Product Errata RHBA-2020:0062 None None None 2020-01-23 11:10:11 UTC

Description Micah Abbott 2019-10-29 18:53:32 UTC
In BZ#1766161, the following was reported

(2019-10-29 15:13:10,455 root         ERROR    NM main-loop aborted: Connection update failed: error=nm-settings-error-quark: failed to update connection: Could not open file '/etc/sysconfig/network-scripts/ifcfg-ens3' for writing: Permission denied (3), dev=ens3/<enum NM_DEVICE_STATE_ACTIVATED of type NM.DeviceState>)

Additional investigation via Slack found:

```
type=AVC msg=audit(1572361975.953:149): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
type=AVC msg=audit(1572361983.181:151): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
type=AVC msg=audit(1572361990.452:152): avc:  denied  { write } for  pid=1477 comm="NetworkManager" name="ifcfg-ens3" dev="vda4" ino=25573980 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0
```

We need to relabel the ifcfg files that get persisted as part of ignition-dracut

Comment 1 Micah Abbott 2019-11-01 20:09:05 UTC
The fix should be present in `ignition-0.33.0-9.rhaos4.3.git3625532.el8` and RHCOS builds after `43.81.201911011508.0`

Comment 4 Michael Nguyen 2019-11-20 17:29:00 UTC
Verified on 4.3.0-0.nightly-2019-11-19-122017

$ oc debug node/ip-10-0-129-117.ec2.internal 
Starting pod/ip-10-0-129-117ec2internal-debug ...
To use host binaries, run `chroot /host`
chroot /host
If you don't see a command prompt, try pressing enter.
chroot /host

# ls -alZ /etc/sysconfig/network-scripts
total 4
drwxr-xr-x. 2 root root system_u:object_r:net_conf_t:s0    6 Nov 20 16:18 .
drwxr-xr-x. 3 root root system_u:object_r:etc_t:s0      4096 Nov 20 16:18 ..
# rpm -q ignition         
ignition-0.33.0-13.rhaos4.3.git3625532.el8.x86_64
sh-4.4# exit
exit
sh-4.2# exit
exit

Removing debug pod ...

Comment 6 errata-xmlrpc 2020-01-23 11:09:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062


Note You need to log in before you can comment on or make changes to this bug.