Description of problem:

When trying to upload new images for the undercloud infrastructure as part of the 16.1.5 overcloud upgrade with:

OS_CLOUD=undercloud openstack overcloud image upload --image-path $(pwd)/images/ --update-existing

the upload fails with:

Apr 13 17:14:14 director1 account-server[6574]: ERROR __call__ error with PUT /d1/123/AUTH_970f54f789eb45e29ae432d1e7342221 : #012Traceback (most recent call
last):#012  File "/usr/lib/python3.6/site-packages/swift/account/server.py", line 291, in __call__#012    res = getattr(self, req.method)(req)#012  File "/usr
/lib/python3.6/site-packages/swift/common/utils.py", line 1982, in _timing_stats#012    resp = func(ctrl, *args, **kwargs)#012  File "/usr/lib/python3.6/site-
packages/swift/account/server.py", line 166, in PUT#012    broker.initialize(timestamp.internal)#012  File "/usr/lib/python3.6/site-packages/swift/common/db.p
y", line 281, in initialize#012    fd, tmp_db_file = mkstemp(suffix='.tmp', dir=self.db_dir)#012  File "/usr/lib64/python3.6/tempfile.py", line 344, in mkstem
p#012    return _mkstemp_inner(dir, prefix, suffix, flags, output_type)#012  File "/usr/lib64/python3.6/tempfile.py", line 262, in _mkstemp_inner#012    fd =
_os.open(file, flags, 0o600)#012PermissionError: [Errno 13] Permission denied: '/srv/node/d1/accounts/123/870/1ed2a87e7530a3e6b2e985422952c870/tmpioohxns8.tmp
' (txn: txa9a00d996b184158a13ee-006075d166)   

Version-Release number of selected component (if applicable):
16.1.5

How reproducible:
100% of the times

Steps to Reproduce:
1. Upgrade director to OSP release 16.1.5
2. Run OS_CLOUD=undercloud openstack overcloud image upload --image-path $(pwd)/images/ --update-existing
3. See it fail with an error 500 which corresponds to the above PermissionDenied on the target swift server container

Actual results:

The upload fails with an error 500 which corresponds to the above PermissionDenied on the target swift server container

Expected results:

The upload succeeds

Additional info:

The following custom policies fixes the problem:

[stack@director1 ~]$ cat openstack-selinux-custom.te

module openstack-selinux-custom 1.0;

require {
        type container_t;
        type swift_data_t;
        class file { append ioctl link unlink create lock open read setattr write getattr rename };                                                          
        class dir { create remove_name read write add_name };
}

#============= container_t ==============
allow container_t swift_data_t:dir { add_name create read remove_name write };
allow container_t swift_data_t:file { append create ioctl link lock open read setattr unlink write getattr rename };