Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1517247 - SELinux is preventing /usr/sbin/NetworkManager from 'connectto' accesses on the unix_stream_socket /run/openvswitch/db.sock.
Summary: SELinux is preventing /usr/sbin/NetworkManager from 'connectto' accesses on t...
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Whiteboard: abrt_hash:78178ec02972fd70426129542cb...
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-24 11:34 UTC by Vladimir Benes
Modified: 2018-04-10 12:48 UTC (History)
6 users (show)

Fixed In Version: selinux-policy-3.13.1-181.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-04-10 12:47:26 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0763 None None None 2018-04-10 12:48:22 UTC

Description Vladimir Benes 2017-11-24 11:34:12 UTC
Description of problem:
creating some default openvswitch configuration in NM 

           $ nmcli conn add conn.type ovs-bridge conn.interface bridge0
           Connection 'ovs-bridge-bridge0' (d10fc64d-1d48-4394-a1b8-e1aea72f27d5) successfully added.
           $ nmcli conn add conn.type ovs-port conn.interface port0 conn.master bridge0
           Connection 'ovs-port-port0' (5ae22bae-bba4-4815-9ade-7e635633e1f0) successfully added.
           $ nmcli conn add conn.type ovs-interface conn.interface iface0 conn.master port0 \
             ipv4.method manual ipv4.address
           Connection 'ovs-interface-iface0' (3640d2a1-a2fd-4718-92f1-cffadb5b6c
dc) successfully added.

       As said above, you need to create a Port even for a single interface.
       Also, before you add the Interface, the Bridge and Port devices appear
       active, but are not configured in OVSDB yet. You can inspect the
       results with ovs-vsctl show.

       Example 2. Adding a Linux interface to a Bridge

           $ nmcli conn add conn.type ovs-port conn.interface port1 conn.master bridge0
           Connection 'ovs-port-port1' (67d041eb-8e7b-4458-afee-a1d07c9c4552) successfully added.
           $ nmcli conn add conn.type ethernet conn.interface eth0 conn.master port1
           Connection 'ovs-slave-eth0' (d459c45c-cf78-4c1c-b4b7-505e71379624) successfully added.

SELinux is preventing /usr/sbin/NetworkManager from 'connectto' accesses on the unix_stream_socket /run/openvswitch/db.sock.

*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************

If you want to allow daemons to enable cluster mode
Then you must tell SELinux about this by enabling the 'daemons_enable_cluster_mode' boolean.

setsebool -P daemons_enable_cluster_mode 1

*****  Plugin catchall (11.6 confidence) suggests   **************************

If you believe that NetworkManager should be allowed connectto access on the db.sock unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'NetworkManager' --raw | audit2allow -M my-NetworkManager
# semodule -i my-NetworkManager.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                system_u:system_r:openvswitch_t:s0
Target Objects                /run/openvswitch/db.sock [ unix_stream_socket ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-1.10.0-1.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-180.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.10.0-783.el7.x86_64 #1 SMP Tue
                              Nov 14 06:28:36 EST 2017 x86_64 x86_64
Alert Count                   87
First Seen                    2017-11-24 10:33:02 CET
Last Seen                     2017-11-24 12:26:23 CET
Local ID                      7280d003-25dc-433c-8c46-1b6482351a72

Raw Audit Messages
type=AVC msg=audit(1511522783.140:1043872): avc:  denied  { connectto } for  pid=8160 comm="NetworkManager" path="/run/openvswitch/db.sock" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=unix_stream_socket

type=SYSCALL msg=audit(1511522783.140:1043872): arch=x86_64 syscall=connect success=no exit=EACCES a0=12 a1=7ffe9a1d9cc0 a2=6e a3=0 items=1 ppid=1 pid=8160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null)

type=CWD msg=audit(1511522783.140:1043872): cwd=/

type=PATH msg=audit(1511522783.140:1043872): item=0 name=/var/run/openvswitch/db.sock inode=27484656 dev=00:13 mode=0140750 ouid=981 ogid=1002 rdev=00:00 obj=system_u:object_r:openvswitch_var_run_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0

Hash: NetworkManager,NetworkManager_t,openvswitch_t,unix_stream_socket,connectto

Version-Release number of selected component:

Additional info:
reporter:       libreport-
hashmarkername: setroubleshoot
kernel:         3.10.0-783.el7.x86_64
reproducible:   Not sure how to reproduce the problem
type:           libreport

Comment 9 errata-xmlrpc 2018-04-10 12:47:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.