AIO Build Fails on SELinux File Context Tasks

Bug #1782798 reported by Luke Short
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack-Ansible
Fix Released
Medium
Unassigned

Bug Description

Environment:
* OS: CentOS 7.5
* OpenStack-Ansible stable/queens branch (commit d38e190e43dfb737e6684096084b9f98f89e0637)
* Ansible: 2.4.4.0
* All-in-one scenario: aio_basekit
* This is a fresh all-in-one install inside a VM with nested virtualization enabled.

Setting the file context appears to fail on all related tasks for the service logs. I first ran into an error with Nova (details shown below). I commented out this task from the nova_selinux role and was able to continue on until the same issue occurred with Neutron logs and changing their SELinux file context. This issue probably affects all services for CentOS deployments.

```
# openstack-ansible setup-openstack.yml
<TRUNCATED>
TASK [os_nova : Set SELinux file contexts for nova's log directory] *************************************
Friday 20 July 2018 15:24:18 +0000 (0:00:00.056) 0:05:34.972 ***********
fatal: [aio1]: FAILED! => {"changed": false, "failed": true, "msg": "ValueError: File spec /openstack/log/aio1-nova(/.*)? conflicts with equivalency rule '/openstack/log /var/log'; Try adding '/var/log/aio1-nova(/.*)?' instead\n"}

PLAY RECAP **********************************************************************************************
aio1 : ok=102 changed=7 unreachable=0 failed=1
aio1_cinder_api_container-583ebfae : ok=87 changed=3 unreachable=0 failed=0
aio1_glance_container-d3f6180b : ok=71 changed=4 unreachable=0 failed=0
aio1_keystone_container-22073d2e : ok=112 changed=8 unreachable=0 failed=0
aio1_nova_api_container-13790926 : ok=96 changed=11 unreachable=0 failed=0
```

Here are the relevant task arguments used in /etc/ansible/roles/os_nova/tasks/nova_selinux.yml:

```
 51 - name: Set SELinux file contexts for nova's log directory
 52 sefcontext:
 53 target: "{{ (nova_log_dir_check.stat.islnk) | ternary(nova_log_dir_check.stat.lnk_target, nova_log_dir) }}(/.*)?"
 54 setype: nova_log_t
 55 state: present
 56 register: selinux_file_context_log_files

```

I also added some additional debug modules to see what variables are being used here.

```
TASK [os_nova : debug] **********************************************************************************
Friday 20 July 2018 15:24:18 +0000 (0:00:00.218) 0:05:34.855 ***********
ok: [aio1] => {
    "nova_log_dir": "/var/log/nova"
}

TASK [os_nova : debug] **********************************************************************************
Friday 20 July 2018 15:24:18 +0000 (0:00:00.059) 0:05:34.915 ***********
ok: [aio1] => {
    "nova_log_dir_check": {
        "changed": false,
        "failed": false,
        "stat": {
            "atime": 1532100242.9404204,
            "attr_flags": "",
            "attributes": [],
            "block_size": 4096,
            "blocks": 0,
            "charset": "binary",
            "ctime": 1532100242.9394205,
            "dev": 64768,
            "device_type": 0,
            "executable": true,
            "exists": true,
            "gid": 989,
            "gr_name": "nova",
            "inode": 114582891,
            "isblk": false,
            "ischr": false,
            "isdir": false,
            "isfifo": false,
            "isgid": false,
            "islnk": true,
            "isreg": false,
            "issock": false,
            "isuid": false,
            "lnk_source": "/openstack/log/aio1-nova",
            "lnk_target": "/openstack/log/aio1-nova",
            "mimetype": "inode/symlink",
            "mode": "0777",
            "mtime": 1532028362.4313076,
            "nlink": 1,
            "path": "/var/log/nova",
            "pw_name": "nova",
            "readable": true,
            "rgrp": true,
            "roth": true,
            "rusr": true,
            "size": 24,
            "uid": 992,
            "version": null,
            "wgrp": true,
            "woth": true,
            "writeable": true,
            "wusr": true,
            "xgrp": true,
            "xoth": true,
            "xusr": true
        }
    }
}
```

Revision history for this message
Mohammed Naser (mnaser) wrote :

We've lost the only maintainer of SELinux inside OSA, so please either try to deploy without SELinux (setenforce 0) .. or patches welcome! :)

Changed in openstack-ansible:
status: New → Incomplete
status: Incomplete → Confirmed
importance: Undecided → Medium
Revision history for this message
Mohammed Naser (mnaser) wrote :
Changed in openstack-ansible:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.