OpenStack Neutron (virtual network service)

file descriptors not closed when executing sub-processes

Reported by Robert Kukura on 2013-02-20
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
High
Robert Kukura
Folsom
High
Robert Kukura

Bug Description

SELinux logs denials such as the following from the ip command (pid 3316) being executed by quantum-dhcp-agent (pid 2604) :

type=AVC msg=audit(1361296820.873:123253): avc: denied { read write } for pid=3316 comm="ip" path="anon_inode:[eventpoll]" dev=anon_inodefs ino=3654 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
type=SYSCALL msg=audit(1361296820.873:123253): arch=c000003e syscall=59 success=yes exit=0 a0=14507d0 a1=127aaa0 a2=108b9b0 a3=0 items=0 ppid=2604 pid=3316 auid=4294967295 uid=164 gid=164 euid=164 suid=164 fsuid=164 egid=164 sgid=164 fsgid=164 tty=(none) ses=4294967295 comm="ip" exe="/sbin/ip" subj=system_u:system_r:ifconfig_t:s0 key=(null)

In this case, it seems a file descriptor opened by eventlet does not have FD_CLOEXEC set, so its left open and ip tries to access it, which is blocked by SELinux. This particular denial is harmless, other than polluting audit.log, but file descriptors other than stdin, stdout and stderr should be closed when sub-processes are executed.

The nova.utils.execute() implementation addresses this by passing close_fds=True to subprocess.Popen(). Quantum should do the same in quantum.common.utils.subprocess_popen() on master and in quantum.agent.linux.execute() on stable/folsom.

dan wendlandt (danwent) wrote :

Doesn't sound like a blocker for G-3, so moving to G-rc1

Changed in quantum:
milestone: grizzly-3 → grizzly-rc1

Fix proposed to branch: master
Review: https://review.openstack.org/22486

Changed in quantum:
status: New → In Progress

Reviewed: https://review.openstack.org/22486
Committed: http://github.com/openstack/quantum/commit/20e517dd2dd550a39c0f842c3e12c34a279d5962
Submitter: Jenkins
Branch: master

commit 20e517dd2dd550a39c0f842c3e12c34a279d5962
Author: Bob Kukura <email address hidden>
Date: Wed Feb 20 16:12:24 2013 -0500

    Close file descriptors when executing sub-processes

    Pass close_fds=True to subprocess.Popen(), as is currently done in
    nova.utils.execute().

    Fixes bug #1130735

    Change-Id: Iec21873d7ef3957847f3b7365fadd613ccf1349d

Changed in quantum:
status: In Progress → Fix Committed

Reviewed: https://review.openstack.org/22494
Committed: http://github.com/openstack/quantum/commit/30bb6329653bb60179598b91ad8a6f378137b533
Submitter: Jenkins
Branch: stable/folsom

commit 30bb6329653bb60179598b91ad8a6f378137b533
Author: Bob Kukura <email address hidden>
Date: Wed Feb 20 17:29:11 2013 -0500

    Close file descriptors when executing sub-processes

    Pass close_fds=True to subprocess.Popen(), as is currently done in
    nova.utils.execute().

    Note that this folsom-stable branch fix is not a cherry-pick of the
    master branch fix at https://review.openstack.org/22486 due to prior
    refactoring in grizzly.

    Fixes bug #1130735

    Change-Id: Ia7a889b21a8069b559cb4641480abf416dfc903c

tags: added: in-stable-folsom
Thierry Carrez (ttx) on 2013-03-13
Changed in quantum:
status: Fix Committed → Fix Released
Thierry Carrez (ttx) on 2013-04-04
Changed in quantum:
milestone: grizzly-rc1 → 2013.1
Alan Pevec (apevec) on 2013-04-07
tags: removed: in-stable-folsom
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers