[Users] engine-cleanup and then engine-setup - Failed to enable SELinux boolean
Hey Mohsen; Did you check /etc/sysconfig/selinux to ensure that "SELINUX=enforcing"? If you set it with setenforce, it would have reverted to whatever is in that file on any reboots. At least that was my problem when I got that error. Tim Hildred, RHCE Content Author II - Engineering Content Services, Red Hat, Inc. Brisbane, Australia Email: thildred@redhat.com Internal: 8588287 Mobile: +61 4 666 25242 IRC: thildred ----- Original Message -----
From: "Mohsen Saeedi" <mohsen.saeedi@gmail.com> To: users@ovirt.org Sent: Monday, September 3, 2012 6:59:47 AM Subject: [Users] engine-cleanup and then engine-setup - Failed to enable SELinux boolean
Hi i'm usign Ovirt 3.1 on the Centos 6.3 x64. I use engine-cleanup and then use engine-setup again. everything was ok but i got the SELinux error at the end of configuration:
Proceed with the configuration listed above? (yes|no): yes
Installing: AIO: Validating CPU Compatibility... [ DONE ] Configuring oVirt-engine... [ DONE ] Creating CA... [ DONE ] Editing JBoss Configuration... [ DONE ] Setting Database Configuration... [ DONE ] Setting Database Security... [ DONE ] Creating Database... [ DONE ] Updating the Default Data Center Storage Type... [ DONE ] Editing oVirt Engine Configuration... [ DONE ] Editing Postgresql Configuration... [ DONE ] Configuring the Default ISO Domain... [ DONE ] Configuring Firewall (iptables)... [ DONE ] Starting JBoss Service... [ DONE ] Handling HTTPD... [ ERROR ] Failed to enable SELinux boolean Please check log file /var/log/ovirt-engine/engine-setup_2012_09_03_01_17_41.log for more information
I Attached the log file.
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
engine-setup show the new error with selinux. when it run semanage command. i use /virt/iso as ISO Domain. I think it generate a bad pattern for add new context.below is some part of log: 2012-09-03 20:37:21::DEBUG::engine-setup::1535::root:: creating directory /virt/iso 2012-09-03 20:37:21::DEBUG::nfsutils::17::root:: adding path /virt/iso to /etc/exports 2012-09-03 20:37:21::DEBUG::nfsutils::36::root:: setting selinux context for /virt/iso 2012-09-03 20:37:21::DEBUG::common_utils::309::root:: Executing command --> '/usr/sbin/semanage fcontext -a -t public_content_rw_t /virt/iso(/.*)?' 2012-09-03 20:37:22::DEBUG::common_utils::335::root:: output = 2012-09-03 20:37:22::DEBUG::common_utils::336::root:: stderr = libsepol.sepol_context_from_string: malformed context "(/.*)?" (Invalid argument). libsepol.sepol_context_from_string: could not construct context from string (Invalid argument). libsemanage.fcontext_parse: invalid security context "(/.*)?" (/etc/selinux/targeted/modules/tmp//file_contexts.local: 6) /virt/iso (/.*)? system_u:object_r:public_content_rw_t:s0 (Invalid argument). libsemanage.fcontext_parse: could not parse file context record (Invalid argument). libsemanage.dbase_file_cache: could not cache file database (Invalid argument). libsemanage.enter_ro: could not enter read-only section (Invalid argument). /usr/sbin/semanage: Could not check if file context for /virt/iso(/.*)? is defined 2012-09-03 20:37:22::DEBUG::common_utils::337::root:: retcode = 1 2012-09-03 20:37:22::ERROR::engine-setup::1566::root:: Traceback (most recent call last): File "/usr/bin/engine-setup", line 1544, in _configNfsShare nfsutils.setSELinuxContextForDir(controller.CONF["NFS_MP"], nfsutils.SELINUX_RW_LABEL) File "/usr/share/ovirt-engine/scripts/nfsutils.py", line 43, in setSELinuxContextForDir utils.execCmd(cmd, None, True, output_messages.ERR_SET_SELINUX_NFS_SHARE) File "/usr/share/ovirt-engine/scripts/common_utils.py", line 340, in execCmd raise Exception(msg) Exception: Failed to set SELINUX policy for NFS share 2012-09-03 20:37:22::DEBUG::setup_sequences::62::root:: Traceback (most recent call last): File "/usr/share/ovirt-engine/scripts/setup_sequences.py", line 60, in run function() File "/usr/bin/engine-setup", line 1567, in _configNfsShare raise Exception(output_messages.ERR_FAILED_CFG_NFS_SHARE) Exception: Failed to configure NFS share on this host 2012-09-03 20:37:22::DEBUG::engine-setup::1733::root:: *** The following params were used as user input: 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: override-httpd-config: yes 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: http-port: 80 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: https-port: 443 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: mac-range: 00:1A:4A:DB:B2:00-00:1A:4A:DB:B2:FF 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: host-fqdn: virt.tcgolestan.ir 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: auth-pass: ******** 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: org-name: TCGolestan 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: default-dc-type: NFS 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: db-remote-install: local 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: db-host: localhost 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: db-local-pass: ******** 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: nfs-mp: /virt/iso 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: iso-domain-name: ISO 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: config-nfs: yes 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: override-iptables: no 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: config-allinone: yes 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: storage-path: /virt/VMs 2012-09-03 20:37:22::DEBUG::engine-setup::1738::root:: superuser-pass: ******** 2012-09-03 20:37:22::ERROR::engine-setup::2367::root:: Traceback (most recent call last): File "/usr/bin/engine-setup", line 2361, in <module> main(confFile) File "/usr/bin/engine-setup", line 2150, in main runSequences() File "/usr/bin/engine-setup", line 2096, in runSequences controller.runAllSequences() File "/usr/share/ovirt-engine/scripts/setup_controller.py", line 54, in runAllSequences sequence.run() File "/usr/share/ovirt-engine/scripts/setup_sequences.py", line 154, in run step.run() File "/usr/share/ovirt-engine/scripts/setup_sequences.py", line 60, in run function() File "/usr/bin/engine-setup", line 1567, in _configNfsShare raise Exception(output_messages.ERR_FAILED_CFG_NFS_SHARE) Exception: Failed to configure NFS share on this host /*Tim Hildred <thildred@redhat.com>*/ wrote on Sun, 2 Sep 2012 19:30:39 -0400 (EDT):
Hey Mohsen;
Did you check /etc/sysconfig/selinux to ensure that "SELINUX=enforcing"?
If you set it with setenforce, it would have reverted to whatever is in that file on any reboots.
At least that was my problem when I got that error.
Tim Hildred, RHCE Content Author II - Engineering Content Services, Red Hat, Inc. Brisbane, Australia Email: thildred@redhat.com Internal: 8588287 Mobile: +61 4 666 25242 IRC: thildred
----- Original Message -----
From: "Mohsen Saeedi" <mohsen.saeedi@gmail.com> To: users@ovirt.org Sent: Monday, September 3, 2012 6:59:47 AM Subject: [Users] engine-cleanup and then engine-setup - Failed to enable SELinux boolean
Hi i'm usign Ovirt 3.1 on the Centos 6.3 x64. I use engine-cleanup and then use engine-setup again. everything was ok but i got the SELinux error at the end of configuration:
Proceed with the configuration listed above? (yes|no): yes
Installing: AIO: Validating CPU Compatibility... [ DONE ] Configuring oVirt-engine... [ DONE ] Creating CA... [ DONE ] Editing JBoss Configuration... [ DONE ] Setting Database Configuration... [ DONE ] Setting Database Security... [ DONE ] Creating Database... [ DONE ] Updating the Default Data Center Storage Type... [ DONE ] Editing oVirt Engine Configuration... [ DONE ] Editing Postgresql Configuration... [ DONE ] Configuring the Default ISO Domain... [ DONE ] Configuring Firewall (iptables)... [ DONE ] Starting JBoss Service... [ DONE ] Handling HTTPD... [ ERROR ] Failed to enable SELinux boolean Please check log file /var/log/ovirt-engine/engine-setup_2012_09_03_01_17_41.log for more information
I Attached the log file.
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
I think the error occur with this line: # Set selinux configuration nfsutils.setSELinuxContextForDir(controller.CONF["NFS_MP"], nfsutils.SELINUX_RW_LABEL) /*Tim Hildred <thildred@redhat.com>*/ wrote on Sun, 2 Sep 2012 19:30:39 -0400 (EDT):
Hey Mohsen;
Did you check /etc/sysconfig/selinux to ensure that "SELINUX=enforcing"?
If you set it with setenforce, it would have reverted to whatever is in that file on any reboots.
At least that was my problem when I got that error.
Tim Hildred, RHCE Content Author II - Engineering Content Services, Red Hat, Inc. Brisbane, Australia Email: thildred@redhat.com Internal: 8588287 Mobile: +61 4 666 25242 IRC: thildred
----- Original Message -----
From: "Mohsen Saeedi" <mohsen.saeedi@gmail.com> To: users@ovirt.org Sent: Monday, September 3, 2012 6:59:47 AM Subject: [Users] engine-cleanup and then engine-setup - Failed to enable SELinux boolean
Hi i'm usign Ovirt 3.1 on the Centos 6.3 x64. I use engine-cleanup and then use engine-setup again. everything was ok but i got the SELinux error at the end of configuration:
Proceed with the configuration listed above? (yes|no): yes
Installing: AIO: Validating CPU Compatibility... [ DONE ] Configuring oVirt-engine... [ DONE ] Creating CA... [ DONE ] Editing JBoss Configuration... [ DONE ] Setting Database Configuration... [ DONE ] Setting Database Security... [ DONE ] Creating Database... [ DONE ] Updating the Default Data Center Storage Type... [ DONE ] Editing oVirt Engine Configuration... [ DONE ] Editing Postgresql Configuration... [ DONE ] Configuring the Default ISO Domain... [ DONE ] Configuring Firewall (iptables)... [ DONE ] Starting JBoss Service... [ DONE ] Handling HTTPD... [ ERROR ] Failed to enable SELinux boolean Please check log file /var/log/ovirt-engine/engine-setup_2012_09_03_01_17_41.log for more information
I Attached the log file.
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
On 09/03/2012 08:56 PM, Mohsen Saeedi wrote:
Another failure occur when handling HTTPD Handling HTTPD... [ ERROR ] Failed to enable SELinux boolean
I found the related line in log: 2012-09-03 22:18:23::DEBUG::setup_sequences::59::root:: running _configureSelinuxBoolean 2012-09-03 22:18:23::DEBUG::engine-setup::672::root:: Enable httpd_can_network_connect boolean 2012-09-03 22:18:23::DEBUG::common_utils::309::root:: Executing command --> '/usr/sbin/setsebool -P httpd_can_network_connect 1' 2012-09-03 22:18:44::DEBUG::common_utils::335::root:: output = 2012-09-03 22:18:44::DEBUG::common_utils::336::root:: stderr = libsepol.sepol_context_from_string: malformed context "(/.*)?" (Invalid argument). libsepol.sepol_context_from_string: could not construct context from string (Invalid argument). libsemanage.fcontext_parse: invalid security context "(/.*)?" (/etc/selinux/targeted/modules/tmp//file_contexts.local: 6) /virt/iso (/.*)? system_u:object_r:public_content_rw_t:s0 (Invalid argument). libsemanage.fcontext_parse: could not parse file context record (Invalid argument). libsemanage.dbase_file_cache: could not cache file database (Invalid argument). libsemanage.enter_ro: could not enter read-only section (Invalid argument). Could not change policy booleans
2012-09-03 22:18:44::DEBUG::common_utils::337::root:: retcode = 255 2012-09-03 22:18:44::DEBUG::setup_sequences::62::root:: Traceback (most recent call last): File "/usr/share/ovirt-engine/scripts/setup_sequences.py", line 60, in run function() File "/usr/bin/engine-setup", line 674, in _configureSelinuxBoolean out, rc = utils.execCmd(cmd, None, True, output_messages.ERR_FAILED_UPDATING_SELINUX_BOOLEAN) File "/usr/share/ovirt-engine/scripts/common_utils.py", line 340, in execCmd raise Exception(msg) Exception: Failed to enable SELinux boolean
Any help? is it a bug?
/*Tim Hildred <thildred@redhat.com>*/ wrote on Sun, 2 Sep 2012 19:30:39 -0400 (EDT):
Hey Mohsen;
Did you check /etc/sysconfig/selinux to ensure that "SELINUX=enforcing"?
If you set it with setenforce, it would have reverted to whatever is in that file on any reboots.
At least that was my problem when I got that error.
Tim Hildred, RHCE Content Author II - Engineering Content Services, Red Hat, Inc. Brisbane, Australia Email:thildred@redhat.com Internal: 8588287 Mobile: +61 4 666 25242 IRC: thildred
----- Original Message -----
From: "Mohsen Saeedi"<mohsen.saeedi@gmail.com> To:users@ovirt.org Sent: Monday, September 3, 2012 6:59:47 AM Subject: [Users] engine-cleanup and then engine-setup - Failed to enable SELinux boolean
Hi i'm usign Ovirt 3.1 on the Centos 6.3 x64. I use engine-cleanup and then use engine-setup again. everything was ok but i got the SELinux error at the end of configuration:
Proceed with the configuration listed above? (yes|no): yes
Installing: AIO: Validating CPU Compatibility... [ DONE ] Configuring oVirt-engine... [ DONE ] Creating CA... [ DONE ] Editing JBoss Configuration... [ DONE ] Setting Database Configuration... [ DONE ] Setting Database Security... [ DONE ] Creating Database... [ DONE ] Updating the Default Data Center Storage Type... [ DONE ] Editing oVirt Engine Configuration... [ DONE ] Editing Postgresql Configuration... [ DONE ] Configuring the Default ISO Domain... [ DONE ] Configuring Firewall (iptables)... [ DONE ] Starting JBoss Service... [ DONE ] Handling HTTPD... [ ERROR ] Failed to enable SELinux boolean Please check log file /var/log/ovirt-engine/engine-setup_2012_09_03_01_17_41.log for more information
I Attached the log file.
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
the last patch i see touching selinux (not sure if made ovirt 3.1) is: commit bab7eadb8dc239c451142ec7130e19f1d13781de Author: Ofer Schreiber <oschreib@redhat.com> Date: Sun Jun 24 10:38:03 2012 +0300 packaging: engine-setup - Use semange instead of setsebool engine-setup should use semanage commands insteam of setsebool, since setsebool works only when selinux is enabled. Change-Id: Ia7cd17036c503c7765887bb7bf26b131c727f0df Signed-off-by: Ofer Schreiber <oschreib@redhat.com>
participants (3)
-
Itamar Heim -
Mohsen Saeedi -
Tim Hildred