Deploying with selinux enforcing causes glance api container to fail to start with podman

[Tim Rozet]

When deploying OOO master (now with podman) and leaving selinux enabled and enforcing, the glance api container fails to start due to:

podman logs glance_api output:

ERROR:__main__:Unexpected error:
Traceback (most recent call last):
  File "/usr/local/bin/kolla_set_configs", line 411, in main
    execute_config_strategy(config)
  File "/usr/local/bin/kolla_set_configs", line 377, in execute_config_strategy
    copy_config(config)
  File "/usr/local/bin/kolla_set_configs", line 306, in copy_config
    config_file.copy()
  File "/usr/local/bin/kolla_set_configs", line 150, in copy
    self._merge_directories(source, dest)
  File "/usr/local/bin/kolla_set_configs", line 94, in _merge_directories
    dir_content = os.listdir(source)
OSError: [Errno 13] Permission denied: '/var/lib/kolla/config_files/src-ceph/'

The /var/lib/kolla/config_files/src-ceph directory does not exist. Ceph is not needed for undercloud so not sure why this mount is there, but it is present in the kolla config:

{
    "command": "/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf",
    "config_files": [
        {
            "dest": "/",
            "merge": true,
            "preserve_properties": true,
            "source": "/var/lib/kolla/config_files/src/*"
        },
        {
            "dest": "/etc/ceph/",
            "merge": true,
            "preserve_properties": true,
            "source": "/var/lib/kolla/config_files/src-ceph/"
        }
    ],
    "permissions": [
        {
            "owner": "glance:glance",
            "path": "/var/lib/glance",
            "recurse": true
        },
        {
            "owner": "glance:glance",
            "path": "/etc/ceph/ceph.client.openstack.keyring",
            "perm": "0600"
        }
    ]
}

[Cédric Jeanneret (cjeanner)]

Hey,

That's weird: on an centos7.6, with enforced SELinux, I could deploy the whole undercloud with podman, and it actually did accept an image in its glance.

We would need some more info, like some extract of the /var/log/audit/audit.log (especially AVC entries), and maybe some more info about your system in order to understand what's going on.

Cheers,

C.

[Bogdan Dobrelya (bogdando)]

This resembles https://bugs.launchpad.net/tripleo/+bug/1802203

[Juan Antonio Osorio Robles (juan-osorio-robles)]

Is this still an issue?

[Tim Rozet (trozet)]

I'm not sure. I just disabled selinux to "fix" it ;)

[Launchpad Janitor (janitor)]

[Expired for tripleo because there has been no activity for 60 days.]