+++ This bug was initially created as a clone of Bug #2096387 +++ Description of problem: icmp health monitors are broken in rhosp16.1 to what appears to be a selinux restriction: type=AVC msg=audit(1655139457.142:1084): avc: denied { execute } for pid=7087 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139460.518:1090): avc: denied { execute } for pid=7093 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139461.328:1091): avc: denied { execute } for pid=7094 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139462.247:1113): avc: denied { execute } for pid=7132 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139465.621:1118): avc: denied { execute } for pid=7157 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139466.431:1119): avc: denied { execute } for pid=7158 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139467.349:1120): avc: denied { execute } for pid=7159 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139470.722:1121): avc: denied { execute } for pid=7164 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139471.532:1122): avc: denied { execute } for pid=7165 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(1655139472.450:1125): avc: denied { execute } for pid=7167 comm="haproxy" name="bash" dev="vda1" ino=4215375 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1655139472.452:1126): avc: denied { execute } for pid=7168 comm="ping-wrapper.sh" name="ping" dev="vda1" ino=4215754 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:ping_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1655139472.452:1126): avc: denied { read open } for pid=7168 comm="ping-wrapper.sh" path="/usr/bin/ping" dev="vda1" ino=4215754 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:ping_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1655139472.452:1126): avc: denied { execute_no_trans } for pid=7168 comm="ping-wrapper.sh" path="/usr/bin/ping" dev="vda1" ino=4215754 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:ping_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1655139472.457:1127): avc: denied { setcap } for pid=7168 comm="ping" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=process permissive=1 type=AVC msg=audit(1655139472.457:1128): avc: denied { create } for pid=7168 comm="ping" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=icmp_socket permissive=1 type=AVC msg=audit(1655139472.457:1129): avc: denied { create } for pid=7168 comm="ping" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=rawip_socket permissive=1 type=AVC msg=audit(1655139472.457:1130): avc: denied { setopt } for pid=7168 comm="ping" lport=1 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=rawip_socket permissive=1 type=AVC msg=audit(1655139472.457:1131): avc: denied { getopt } for pid=7168 comm="ping" lport=1 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=rawip_socket permissive=1 type=AVC msg=audit(1655139496.100:1133): avc: denied { execmem } for pid=7217 comm="haproxy" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:system_r:haproxy_t:s0 tclass=process permissive=1 [root@amphora-511460b7-c49e-4e3c-aa25-b40b6a162d4a audit]# grep denied audit.log | audit2allow -R require { type haproxy_t; type shell_exec_t; type ping_exec_t; class process { execmem setcap }; class icmp_socket create; class rawip_socket { create getopt setopt }; class file { execute execute_no_trans open read }; } #============= haproxy_t ============== allow haproxy_t ping_exec_t:file { execute execute_no_trans open read }; allow haproxy_t self:icmp_socket create; #!!!! This avc can be allowed using the boolean 'cluster_use_execmem' allow haproxy_t self:process execmem; allow haproxy_t self:process setcap; allow haproxy_t self:rawip_socket { create getopt setopt } Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 16.2.4), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8794