9:22 a.m.
Hi,
after CentOS upgrade from 7.3 to 7.4 we are seeing that VMs fail to hard
reboot due to permission denied in console.log
type=AVC msg=audit(1510742012.661:4254): avc: denied { unlink } for
pid=8230 comm="virtlogd" name="console.log" dev="md4"
ino=1610669936
scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:svirt_image_t:s0:c29,c202 tclass=file
We found these two related open bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1501957
https://bugzilla.redhat.com/show_bug.cgi?id=1499800
Restoring the context of console.log (restorecon -F console.log) fix the
issue but wondering if it's safe to apply this at scale.
Also, when can we expect a formal fix?
thanks,
Belmiro
CERN
3:46 p.m.
Hi Belmiro,
Restoring the context of console.log (restorecon -F console.log) fix
the
issue but wondering if it's safe to apply this at scale.
Also, when can we expect a formal fix?
please test with latest openstack-selinux-0.8.11 which should include
those fixes,
you can grab it for now from CBS Koji
http://cbs.centos.org/koji/buildinfo?buildID=20756
until it's pushed through the promotion process.
Cheers,
Alan
1:03 a.m.
Hi Alan,
just tested this package and it fixes the problem for us.
Any idea when it will be moved to "cloud7-openstack-common-release".
Currently we are running "openstack-selinux-0.8.7-1.el7"
thank you,
Belmiro
CERN
On Thu, Nov 16, 2017 at 10:46 PM, Alan Pevec <apevec(a)redhat.com> wrote:
Hi Belmiro,
> Restoring the context of console.log (restorecon -F console.log) fix the
> issue but wondering if it's safe to apply this at scale.
> Also, when can we expect a formal fix?
please test with latest openstack-selinux-0.8.11 which should include
those fixes,
you can grab it for now from CBS Koji
http://cbs.centos.org/koji/buildinfo?buildID=20756
until it's pushed through the promotion process.
Cheers,
Alan
_______________________________________________
dev mailing list
dev(a)lists.rdoproject.org
http://lists.rdoproject.org/mailman/listinfo/dev
To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org
3:27 a.m.
On Fri, Nov 17, 2017 at 8:03 AM, Belmiro Moreira <
moreira.belmiro.email.lists(a)gmail.com> wrote:
Hi Alan,
just tested this package and it fixes the problem for us.
Any idea when it will be moved to "cloud7-openstack-common-release".
Currently we are running "openstack-selinux-0.8.7-1.el7"
I've just proposed https://review.rdoproject.org/r/#/c/10561/ to push it to
testing repo. Once merge i'll propose it to production repo
thank you,
Belmiro
CERN
On Thu, Nov 16, 2017 at 10:46 PM, Alan Pevec <apevec(a)redhat.com> wrote:
> Hi Belmiro,
>
> > Restoring the context of console.log (restorecon -F console.log) fix the
> > issue but wondering if it's safe to apply this at scale.
> > Also, when can we expect a formal fix?
>
> please test with latest openstack-selinux-0.8.11 which should include
> those fixes,
> you can grab it for now from CBS Koji
> http://cbs.centos.org/koji/buildinfo?buildID=20756
> until it's pushed through the promotion process.
>
> Cheers,
> Alan
> _______________________________________________
> dev mailing list
> dev(a)lists.rdoproject.org
> http://lists.rdoproject.org/mailman/listinfo/dev
>
> To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org
>
_______________________________________________
dev mailing list
dev(a)lists.rdoproject.org
http://lists.rdoproject.org/mailman/listinfo/dev
To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org
2:53 a.m.
Hi Alfredo,
thanks.
The package moved to testing more than 10 days ago.
Any idea when it can be moved to "release"?
Belmiro
CERN
On Fri, Nov 17, 2017 at 10:27 AM, Alfredo Moralejo Alonso <
amoralej(a)redhat.com> wrote:
On Fri, Nov 17, 2017 at 8:03 AM, Belmiro Moreira <
moreira.belmiro.email.lists(a)gmail.com> wrote:
> Hi Alan,
> just tested this package and it fixes the problem for us.
>
> Any idea when it will be moved to "cloud7-openstack-common-release".
> Currently we are running "openstack-selinux-0.8.7-1.el7"
>
>
I've just proposed https://review.rdoproject.org/r/#/c/10561/ to push it
to testing repo. Once merge i'll propose it to production repo
> thank you,
> Belmiro
> CERN
>
> On Thu, Nov 16, 2017 at 10:46 PM, Alan Pevec <apevec(a)redhat.com> wrote:
>
>> Hi Belmiro,
>>
>> > Restoring the context of console.log (restorecon -F console.log) fix
>> the
>> > issue but wondering if it's safe to apply this at scale.
>> > Also, when can we expect a formal fix?
>>
>> please test with latest openstack-selinux-0.8.11 which should include
>> those fixes,
>> you can grab it for now from CBS Koji
>> http://cbs.centos.org/koji/buildinfo?buildID=20756
>> until it's pushed through the promotion process.
>>
>> Cheers,
>> Alan
>> _______________________________________________
>> dev mailing list
>> dev(a)lists.rdoproject.org
>> http://lists.rdoproject.org/mailman/listinfo/dev
>>
>> To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org
>>
>
>
> _______________________________________________
> dev mailing list
> dev(a)lists.rdoproject.org
> http://lists.rdoproject.org/mailman/listinfo/dev
>
> To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org
>
>
2343
days inactive
2355
days old
4 comments
3 participants
participants (3)
-
Alan Pevec -
Alfredo Moralejo Alonso -
Belmiro Moreira