neutron-server on restart is triggering AVCs on a number of files

[YaZug]

using delorian installed via packstack --allinone I noticed that if we restart neutron-server it generates a number of AVCs for getattr on 87 files

neutron==7.0.0.0b4.dev223

sample of a few entries from /var/log/audit.log from centos 7

type=AVC msg=audit(1442855709.922:10594): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/hostname" dev="dm-0" ino=67231056 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10595): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/fusermount" dev="dm-0" ino=70253714 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:fusermount_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10596): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-api" dev="dm-0" ino=69439463 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_api_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10597): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-registry" dev="dm-0" ino=69439474 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_registry_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.923:10598): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-scrubber" dev="dm-0" ino=69439476 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_scrubber_exec_t:

[Lon Hohberger (lhh)]

The question I have is - what's neutron-server doing statting a bunch of files during startup? Does it need to, or is this a child task doing it?

child task -> these are candidates for dontaudit rules
neutron needs to do this -> these are candidates for expanding neutron's permissions

[Armando Migliaccio (armando-migliaccio)]

This bug is > 240 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]