yahoo-eng-team team mailing list archive

[Erno Kuvaja <jokke@xxxxxx>]

This is a bug in RDO packaging rather than bug in Glance. Please file
the bug in RDO [0] and you have much more luck to get it fixed.

[0] https://bugzilla.redhat.com/enter_bug.cgi?product=RDO

** Changed in: glance
       Status: New => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1774402

Title:
  Glance scrubber SELinux denials

Status in Glance:
  Invalid

Bug description:
  Glance scrubber on RHEL7 from RDO with SELinux enabled get denied
  connecting to cinder & swift

  type=AVC msg=audit(1527765224.059:149655): avc:  denied  { name_connect } for  pid=1283 comm="glance-scrubber" dest=8776 scontext=system_u:system_r:glance_scrubber_t:s0 tcontext=
  system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
  type=AVC msg=audit(1527765228.066:149656): avc:  denied  { name_connect } for  pid=1283 comm="glance-scrubber" dest=8776 scontext=system_u:system_r:glance_scrubber_t:s0 tcontext=
  system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
  type=AVC msg=audit(1527765228.690:149657): avc:  denied  { name_connect } for  pid=1283 comm="glance-scrubber" dest=8080 scontext=system_u:system_r:glance_scrubber_t:s0 tcontext=
  system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

  Enabling the nis_enabled seboolean allows connections to cinder,

  swift looks to need

  allow glance_scrubber_t http_cache_port_t:tcp_socket name_connect;

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1774402/+subscriptions