<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> <div>Scratch that last post. :)</div> <div><br> </div> <div>I think I'm mistaken, and the setting WILL persist across reboots ...</div> <div><br> </div> <div>Andy</div> <div><br> </div> <span id="OLK_SRC_BODY_SECTION"> <div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"> <span style="font-weight:bold">From: </span>Andy Ingham <<a href="mailto:andy.ingham@duke.edu">andy.ingham@duke.edu</a>><br> <span style="font-weight:bold">Reply-To: </span>"<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br> <span style="font-weight:bold">Date: </span>Thursday, November 13, 2014 at 1:38 PM<br> <span style="font-weight:bold">To: </span>"<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br> <span style="font-weight:bold">Subject: </span>Re: [Spacewalk-list] CentOS 6.6 upgrade breaks osad on SW 2.1 clients that have SELinux in enforcing mode<br> </div> <div><br> </div> <div> <div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> <div>This is a fine workaround EXCEPT be aware that it does NOT persist across reboots.</div> <div><br> </div> <div>That is, you'll have to re-run the command after every reboot. (I'm hoping someone can indicate that I'm wrong on this, but I don't see a "persistent" option for that command).</div> <div><br> </div> <div>Andy</div> <div><br> </div> <span id="OLK_SRC_BODY_SECTION"> <div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"> <span style="font-weight:bold">From: </span>ndegz <<a href="mailto:nndegz@gmail.com">nndegz@gmail.com</a>><br> <span style="font-weight:bold">Reply-To: </span>"<a href="mailto:nndegz+list@gmail.com">nndegz+list@gmail.com</a>" <<a href="mailto:nndegz+list@gmail.com">nndegz+list@gmail.com</a>>, "<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br> <span style="font-weight:bold">Date: </span>Friday, November 7, 2014 at 3:18 PM<br> <span style="font-weight:bold">To: </span>"<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br> <span style="font-weight:bold">Subject: </span>Re: [Spacewalk-list] CentOS 6.6 upgrade breaks osad on SW 2.1 clients that have SELinux in enforcing mode<br> </div> <div><br> </div> <div> <div> <div dir="ltr">Ran into the same issue and found this blog post<br> <a href="http://blog.christian-stankowic.de/?p=6341&lang=en">Short tip: osad: Unable to connect to the host and port specified (EL6.6 + EL7)</a><br> <br> semanage permissive -a osad_t<br> <br> <br> <br> </div> <div class="gmail_extra"><br> <div class="gmail_quote">On Thu, Nov 6, 2014 at 12:59 PM, Kevin Sandy <span dir="ltr"> <<a href="mailto:kevin@digitallotus.com" target="_blank">kevin@digitallotus.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div style="word-wrap:break-word">I’ve been seeing this as well. Clients are on CentOS 6.6 with Spacewalk 2.2. I’ve had to put SELinux in permissive mode for now. <div><span class="HOEnZb"><font color="#888888"><br> <div> <div style="color:rgb(0,0,0);font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"> <span style="font-size:9px"><br> -- kevin</span></div> <div style="color:rgb(0,0,0);font-family:Verdana;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"> <br> </div> <br> </div> </font></span> <div> <div class="h5"><br> <div> <div>On Nov 6, 2014, at 12:48 PM, Andy Ingham <<a href="mailto:andy.ingham@duke.edu" target="_blank">andy.ingham@duke.edu</a>> wrote:</div> <br> <blockquote type="cite">Ever since updating from CentOS 6.5 > 6.6, my servers (which are all at<br> spacewalk client version 2.1) are showing:<br> <br> <br> +++++++++++++++++++++++++<br> SELinux is preventing /usr/bin/python from name_connect access on the<br> tcp_socket .<br> <br> ***** Plugin catchall (100. confidence) suggests<br> ***************************<br> <br> If you believe that python should be allowed name_connect access on the<br> tcp_socket by default.<br> Then you should report this as a bug.<br> You can generate a local policy module to allow this access.<br> Do<br> allow this access for now by executing:<br> # grep osad /var/log/audit/audit.log | audit2allow -M mypol<br> # semodule -i mypol.pp<br> +++++++++++++++++++++++++<br> <br> <br> <br> <br> <br> And FWIW, attempting to mitigate by adding a local policy (as the above<br> notice instructs) ALSO FAILS:<br> <br> [root@HOSTNAME local_policy]# semodule -i osad.pp<br> libsepol.print_missing_requirements: osad's global requirements were not<br> met: type/attribute osad_t (No such file or directory).<br> libsemanage.semanage_link_sandbox: Link packages failed (No such file or<br> directory).<br> semodule: Failed!<br> <br> <br> <br> <br> <br> Is this a known issue?<br> <br> <br> Andy<br> <br> Andy Ingham<br> IT Infrastructure<br> Fuqua School of Business<br> Duke University<br> <br> <br> <br> <br> <br> <br> _______________________________________________<br> Spacewalk-list mailing list<br> <a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br> </blockquote> </div> <br> </div> </div> </div> </div> <br> _______________________________________________<br> Spacewalk-list mailing list<br> <a href="mailto:Spacewalk-list@redhat.com">Spacewalk-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br> </blockquote> </div> <br> </div> </div> </div> </span></div> </div> </span> </body> </html>