RHEA-2015:0144 - Product Enhancement Advisory

Topic

New packages are available for Red Hat Enterprise Linux OpenStack Platform
OpenStack 6.0 (Juno).

Description

Red Hat Enterprise Linux OpenStack Platform provides the facilities for
building a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

This advisory includes run-time and Technology Preview components for
OpenStack.

Technology Preview components include:

• OpenStack Trove
• OpenStack Ironic
• OpenStack Tuskar
• OpenStack TripleO
• qpid-proton & python-pyngus - AMQP 1.0 support for OpenStack

This update addresses the following high bugs:

• SELinux did not allow OpenStack Networking to spawn radvd, leading to

OpenStack Networking failing to run properly.

With this update, SELinux is given the 'allow' rules so that OpenStack
Networking can successfully spawn radvd. (BZ#1168526)

• SELinux did not allow OpenStack Networking to fully interact with

'keepalived', leading to OpenStack Networking failing to run properly.

With this update, SELinux is given the proper 'allow' rules so that
OpenStack Networking can successfully run without any issues. (BZ#1169859)

• OpenStack Networking CI was generating some AVCs, as a result, SELinux

caused Compute Networking to fail.

With this update, SELinux is given the proper 'allow' rules so that Compute
Networking can successfully run without any errors. (BZ#1170839)

• OpenStack Networking failed to run with SELinux enabled, resulting in

AVCs being generated in the audit.log file.

With this update, OpenStack Networking has the ability to access
netlink_socket and runs without generating any AVCs. (BZ#1171458)

• SELinux prevented OpenStack Networking from creating a net link socket,

resulting in AVCs being generated.

With this update, OpenStack Networking has the permissions to create a net
link socket and runs without issues. (BZ#1171462)

• Keepalived created files on the fly causing AVC denials, as a result,

SELinux prevented keepalived deamon from running.

With this update, keepalived is able to transition to OpenStack Networking
and is given other 'allow' rules. As a result, it runs without any issues.
(BZ#1180679)

• SELinux blocked the iscsiadm search command, resulting in operation

failure and AVCs being generated.

With this update, virtd_t is transitioned to iscsid and iscsi runs without
issues. (BZ#1181428)

• With this release, the python-tooz package has been rebased to version

0.10. This rebase adds support for specifying a redis-sentinel in the
backend URL. This allows ceilometer fail over between a cluster of redis
services, as to avoid the redis service being a single point of failure.

As a result, the tooz client can use a cluster of redis services as the
backend with the sentinel failing over mastership of the cluster as
necessary.(BZ#1180335)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 6 runs on Red Hat Enterprise
Linux 7.0.

The Red Hat Enterprise Linux OpenStack Platform 6 Release Notes contain the
following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat Enterprise Linux OpenStack Platform 6,

including which channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/6/html/Release_Notes/index.html

This update is available through the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at:
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat OpenStack 6.0 x86_64

Fixes

• BZ - 1125978 - [CISCO RHEL-OSP] Need to include ncclient in the OSP repo
• BZ - 1168526 - SELinux prevents Neutron from spawning radvd
• BZ - 1169859 - Neutron l3-agent has SELinux denial when starting or stopping keepalived
• BZ - 1170839 - Neutron CI failure generating AVCs
• BZ - 1171458 - SELinux is preventing /usr/sbin/conntrack from create access on the netlink_socket
• BZ - 1171462 - SELinux is preventing /usr/sbin/haproxy from search access on the directory
• BZ - 1180335 - rebase python-tooz to 0.10
• BZ - 1180679 - Denials prevent keepalived from binding when launched by neutron (to implement L3 HA; l3_ha=True)
• BZ - 1180881 - different AVCs while using Keepalived on HA VRRP setup
• BZ - 1181428 - selinux blocks iscsiadm search command

CVEs

(none)

References

(none)