Bug 985503 - oo-accept-broker needs to check httpd_execmem
Summary: oo-accept-broker needs to check httpd_execmem
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Node
Version: 1.2.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Miciah Dashiel Butler Masters
QA Contact: libra bugs
URL:
Whiteboard:
Depends On:
Blocks: 991223
TreeView+ depends on / blocked
 
Reported: 2013-07-17 15:51 UTC by Miciah Dashiel Butler Masters
Modified: 2017-03-08 17:35 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
The broker and management console both require the httpd_execmem SELinux Boolean to be enabled, but this was missing from the installation script. With this fix, the installation script was updated to correctly enable httpd_execmem for new installations. The oo-accept-broker command has also been updated to inform administrators if this setting is missing on an existing installation.
Clone Of:
: 991223 (view as bug list)
Environment:
Last Closed: 2013-08-05 17:20:15 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:1138 0 normal SHIPPED_LIVE OpenShift Enterprise 1.2.1 bug fix and enhancement update 2013-08-05 21:14:54 UTC

Description Miciah Dashiel Butler Masters 2013-07-17 15:51:07 UTC 
Description of problem:
oo-accept-broker needs to check the httpd_execmem SELinux Boolean.

The broker and the console both need httpd_execmem to be enabled (the broker and the console both use Passenger, which executes writable memory, and the console uses The Ruby Racer, which uses V8, which also executes writable memory).


Version-Release number of selected component (if applicable):
OSE 1.2.1.


How reproducible:
Easily.


Steps to Reproduce:
1. Run `setsebool httpd_execmem=false`.
2. Run `oo-accept-broker`.


Actual results:
Previously, oo-accept-broker did not report any problem with SELinux.


Expected results:
oo-accept-broker should report a failure because httpd_execmem is not enabled.


Additional info:
https://github.com/openshift/enterprise-server/pull/104 (merged).
https://github.com/openshift/origin-server/pull/3064 (awaiting review).
Bug 983686 (documentation bug).
Comment 2 Johnny Liu 2013-07-18 03:43:12 UTC 
Verified this bug with 1.2/2013-07-17.1, and PASS.

# setsebool httpd_execmem=false
# getsebool httpd_execmem
httpd_execmem --> off
# oo-accept-broker -v
...
FAIL: SELinux boolean httpd_execmem is disabled -- run setsebool -P httpd_execmem=on
...
Comment 5 errata-xmlrpc 2013-08-05 17:20:15 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1138.html
Note You need to log in before you can comment on or make changes to this bug.