Hide Forgot
Description of problem: Pretty sure running selinux in permissive mode is meant to be a temporary workaround. Pretty sure we do not want to release this way. I ran across this on a reboot and after a discussion with Wes, this is the real issue. snippet of errors in /var/log/audit/audit.log ================================================================ type=AVC msg=audit(1301601180.778:109017): avc: denied { name_connect } for pid=1695 comm="httpd" dest=3000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ntop_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1301601180.778:109017): arch=c000003e syscall=42 success=no exit=-13 a0=d a1=7fe28ca35a48 a2=10 a3=7fff6996c47c items=0 ppid=1689 pid=1695 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
This may already be addressed for the conductor web ui, but let's verify.
There is a boolean httpd_can_network_connect which should allow this. Could you test it using setsebool httpd_can_network_connect on
This is an error generated from selinux policy for mod_proxy. So, before aeolus-configure was setting selinux as Miroslav said, now i don't know how is managed, but since we want to use Apache2 we need to set this boolean somehow.
making sure all the bugs are at the right version for future queries
good 2 go with [root@qeblade29 ~]# rpm -qa | grep aeolus | sort aeolus-all-0.7.0-4.el6.noarch aeolus-conductor-0.7.0-4.el6.noarch aeolus-conductor-daemons-0.7.0-4.el6.noarch aeolus-conductor-doc-0.7.0-4.el6.noarch aeolus-configure-2.4.0-3.el6.noarch rubygem-aeolus-cli-0.2.0-3.el6.noarch rubygem-aeolus-image-0.2.0-1.el6.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2012-0583.html