Live Migration failure under centos - SELinux AVC: can't use nova's ssh keys

[Major Hayden]

When nova tries to ssh to another host to do a live migration on CentOS 7, the receiving host will have an SELinux AVC when it tries to read /var/lib/nova/.ssh/.authorized_keys. The SELinux equivalency that was set up in the past for /var/lib/nova may need to be removed and replaced with something else.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/534891

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/534891
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_nova/commit/?id=1a483db8d0fd629dc792c6160c182def57ee3ad3
Submitter: Zuul
Branch: master

commit 1a483db8d0fd629dc792c6160c182def57ee3ad3
Author: Major Hayden <email address hidden>
Date: Wed Jan 31 09:16:14 2018 -0600

    Fix SELinux file contexts for nova's ssh keys

    The original SELinux file context equivalance that was added for
    /var/lib/nova was too broad and needs to be made more specific.

    This patch removes the old equivalence record and replaces it with
    a specific file context rule. This allows live migrations to work
    with CentOS 7 systems that have SELinux in enforcing mode.

    Closes-Bug: 1742732
    Depends-On: I52901ac48f9a95d0fe6b010f5940b5c39fce1aba
    Change-Id: I8f7c750edc1c7b354343f07230eb17d1357001de

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/539948

[OpenStack Infra (hudson-openstack)]

Change abandoned by Major Hayden (<email address hidden>) on branch: stable/pike
Review: https://review.openstack.org/539948
Reason: Nevermind. I don't think we need this in Pike.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible-os_nova 17.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/queens
Review: https://review.openstack.org/559490

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/564228

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/564228
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_nova/commit/?id=6d4568f59c78acad6843bef3d458e2867aa81e4b
Submitter: Zuul
Branch: master

commit 6d4568f59c78acad6843bef3d458e2867aa81e4b
Author: Vadim Kuznetsov <email address hidden>
Date: Sat Apr 7 09:22:31 2018 -0400

    Fix removal of SELinux fcontext

    Delete fcontext when equivalence is in the context

    Change-Id: I7f3b2c4b5b53c6152d73343af1906ed8fa46640b
    Related-Bug: 1742732

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/559490
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_nova/commit/?id=511060612640b71025b633c18885b31bafcbbcdc
Submitter: Zuul
Branch: stable/queens

commit 511060612640b71025b633c18885b31bafcbbcdc
Author: Vadim Kuznetsov <email address hidden>
Date: Sat Apr 7 09:22:31 2018 -0400

    Fix removal of SELinux fcontext

    Delete fcontext when equivalence is in the context

    Change-Id: I7f3b2c4b5b53c6152d73343af1906ed8fa46640b
    Related-Bug: 1742732
    (cherry picked from commit 6d4568f59c78acad6843bef3d458e2867aa81e4b)