Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 920662

Summary:	Nova: SELinux AVC Errors for "iptables-save" / "iptables-restor"
Product:	Red Hat OpenStack	Reporter:	Lon Hohberger <lhh>
Component:	doc-Release_Notes	Assignee:	Bruce Reeler <breeler>
Status:	CLOSED CURRENTRELEASE	QA Contact:	ecs-bugs
Severity:	low	Docs Contact:
Priority:	low
Version:	2.0 (Folsom)	CC:	aortega, breeler, derekh, dwalsh, eparis, lhh, mgrepl, ndipanov, ohochman, rlandman, sgordon, ykaul
Target Milestone:	snapshot5	Keywords:	Documentation, Triaged
Target Release:	2.1	Flags:	lhh: needinfo-
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Known Issue
Doc Text:	The limit set for Nova processes may be exceeded in very large deployments. Then a problem may occur where you get AVC denials for sys_resource and sys_admin while running Nova. For example: avc: denied { sys_admin } for pid=16497 comm="iptables-save" capability=21 scontext=unconfined_u:system_r:iptables_t:s0 tcontext=unconfined_u:system_r:iptables_t:s0 tclass=capability Due to the way process inheritance is set up on Linux, calling sudo inherits the caller's ulimit. Processes owned by the new UID are counted against the inherited ulimit. Transitioning to the iptables domain drops the ability to break the soft ulimit for number of processes, which causes iptables commands to fail in certain cases. Currently the limit to the number of processes is set to 2048 for the Nova user. While this limit should work for most installations, very large deployments may need a workaround. The workaround is to increase the limit by editing the /etc/security/limits.d/91-nova.conf file. For example, change: nova soft nproc 2048 to: nova soft nproc 4096	Story Points:	---
Clone Of:	917534
Clones:	1102484 (view as bug list)		Environment:
Last Closed:	2013-05-17 14:24:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	917534
Bug Blocks:	917370, 1102484

Comment 1 Lon Hohberger 2013-03-12 14:04:36 UTC

We need to document how to increase the ulimit for the nova user to a larger value so that when commands are run through 'sudo'.  This is because the default 1024 limit for the 'nova' user is hit easily, since sudo does not set the ulimit to the root user.  Ordinarily this would not matter, but with SELinux, certain commands do not have CAP_SYS_ADMIN or CAP_SYS_RESOURCE (iptables is one).

Generally, simply add:

nobody     soft    nproc     2048

...to /etc/security/limits.d/90-nproc.conf

Comment 3 Lon Hohberger 2013-03-12 14:51:46 UTC

If we drop in 90-nova.conf in /etc/security/limits.d from the openstack-nova package, this isn't needed unless the limit is hit - so, this would become illustrating how to increase the number for the nova user, as opposed to a required step during setup.

Comment 4 Stephen Gordon 2013-03-13 12:42:46 UTC

Hi Lon,

Can we get an indication of which approach is going to be taken for RHOS 2.1? We're past the content freeze at this point and rapidly approaching the point where outstanding issues will be actioned as release notes only.

Thanks,

Steve

Comment 5 Lon Hohberger 2013-03-13 17:03:02 UTC

So, what we did was increase the ulimit for the nova user to 2048 by dropping 91-nova.conf in /etc/security/limits.d.

So, if we're to document this, all we need to do is tell users how to increase the limit by editing /etc/security/limits.d/91-nova.conf:

e.g. change:

  nobody     soft    nproc     2048

to:

  nobody     soft    nproc     4096

I think it's unlikely that we'll hit the 2048 limit, however.  This could be low priority or even simply a kbase article if needed.

Comment 6 Stephen Gordon 2013-03-13 17:21:37 UTC

Ok, on that basis I am going to move it over to the release notes component.

Comment 7 Bruce Reeler 2013-04-03 09:27:49 UTC

from https://bugzilla.redhat.com/show_bug.cgi?id=917534

# Due to the way process inheritance is set up on Linux,
# calling sudo inherits the caller's ulimit.  Processes
# owned by the new UID are counted against inherited
# ulimit.
#
# Transitioning to the iptables domain drops the ability
# to break the soft ulimit for number of processes, which
# causes iptables commands to fail in certain cases.
#
but still need a succinct error description to precede this for Doc Text &relnotes

Comment 8 Bruce Reeler 2013-04-06 13:52:48 UTC

@Lon -NEEDINFO- Could you please provide a succinct error description to precede the text in the Doc Text field, which I can then add to the Release Notes. Thanks.

Comment 9 Bruce Reeler 2013-04-21 04:14:18 UTC

Doc Text added to Release Notes.

Change-Id: Ie7b7ab242d9075ac7685baa04587482e3a5045bc

Comment 10 Stephen Gordon 2013-05-17 14:24:04 UTC

Closing but leaving the flags on - this release note still applies for 3.0.