Bug 750271 - sebool option httpd_can_network_connect doesn't persist on reboot
Summary: sebool option httpd_can_network_connect doesn't persist on reboot
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: CloudForms Cloud Engine
Classification: Retired
Component: aeolus-configure
Version: 1.0.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
Assignee: chris alfonso
QA Contact: wes hayutin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-10-31 14:35 UTC by James Laska
Modified: 2016-02-01 02:35 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-30 17:16:50 UTC
Embargoed:


Attachments (Terms of Use)
0001-Fix-for-bug-750271.patch (884 bytes, patch)
2011-10-31 14:36 UTC, James Laska
no flags Details | Diff

Description James Laska 2011-10-31 14:35:34 UTC
Description of problem:

10:01:03   funzo: configure is running /usr/sbin/setsebool httpd_can_network_connect 1 but that will not persist across reboots
10:01:08   funzo: jlaska: ^
10:01:18   jlaska: ah, needs to add -P ?
10:01:27   funzo: yes, I believe that is the solution

Version-Release number of selected component (if applicable):
 * aeolus-configure-2.2.0-1.20111024205543gitf9232cc.el6.noarch

Steps to Reproduce:
1. Install RHEL6.1 and enable aeolus repos
2. Configure aeolus and get a working setup according to aeolusproject.org instructions
3. Reboot guest
4. Attempt to access conductor web

Actual results:

Fails, see /var/log/httpd/error_log details at http://fpaste.org/ODRh/

Expected results:

Should work as it did in step#2

Additional info:

 * I was able to resolve this problem by setting SELinux to permissive mode, and restarting conductor and apache.

Comment 1 James Laska 2011-10-31 14:36:44 UTC
Created attachment 530988 [details]
0001-Fix-for-bug-750271.patch

Attached patch resolves the issue

Comment 2 chris alfonso 2011-10-31 18:58:54 UTC
commit 5bc5588062595818f6f04fa8ee05c5151813bef1
aeolus-configure git repo

Comment 3 Aziza Karol 2011-11-23 13:06:27 UTC
Recreated the above steps.
After rebooting I was able to access conductor web successfully.

No Error was observed in /var/log/httpd/error_log.

init.pp

  # if selinux is enabled and we want to use mod_proxy, we need todo this
  exec{'permit-http-networking':
         command => '/usr/sbin/setsebool -P httpd_can_network_connect 1',
         logoutput => true,
         unless   => "/usr/bin/test 'Disabled' = `/usr/sbin/getenforce`"
  }


[root@hp-bl490cg6-01 ~]# rpm -qa | grep aeolus
rubygem-aeolus-image-0.1.0-6.el6.noarch
rubygem-rack-mount-0.7.1-3.aeolus.el6.noarch
rubygem-aeolus-cli-0.1.0-4.el6.noarch
aeolus-conductor-doc-0.7.0-0.20111122193230git4823c2b.el6.noarch
aeolus-all-0.7.0-0.20111122193230git4823c2b.el6.noarch
rubygem-arel-2.0.10-0.aeolus.el6.noarch
aeolus-conductor-daemons-0.7.0-0.20111122193230git4823c2b.el6.noarch
aeolus-configure-2.4.0-0.20111118150133gitde3c009.el6.noarch
rubygem-ZenTest-4.3.3-2.aeolus.el6.noarch
aeolus-conductor-0.7.0-0.20111122193230git4823c2b.el6.noarch


Note You need to log in before you can comment on or make changes to this bug.