https://bugzilla.redhat.com/show_bug.cgi?id=1228918
Bug ID: 1228918
Summary: selinux denies rsyslog logging to elasticsearch via
rsyslog-elasticsearch
Product: Fedora
Version: 22
Component: elasticsearch
Assignee: jvanek(a)redhat.com
Reporter: david(a)algorithmicarmada.com
QA Contact: extras-qa(a)fedoraproject.org
CC: bkabrda(a)redhat.com, bobjensen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, pbrobinson(a)gmail.com,
zbyszek(a)in.waw.pl
Created attachment 1035659
-->
https://bugzilla.redhat.com/attachment.cgi?id=1035659&action=edit
/etc/rsyslog.d/elasticsearch.conf
Description of problem:
The package rsyslog-elasticsearch is broken out-of-the-box. rsyslog attempting
to log to elasticsearch results in the following AVC denials if NIS_ENABLED is
off:
Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for
pid=734 comm=72733A616374696F6E203120717565 dest=9200
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for
pid=734 comm=72733A616374696F6E203120717565 dest=9200
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for
pid=731 comm=72733A616374696F6E203120717565 dest=9200
scontext=system_u:system_r:syslogd_t:s0
Installation of the package rsyslog-elasticsearch should allow rsyslog to
connect to elasticsearch's particular port, without opening rsyslog to all
ports, and also without impacting other installed programs.
Version-Release number of selected component (if applicable):
Fedora 22 Server
$ dnf list elasticsearch rsyslog-elasticsearch rsyslog
Last metadata expiration check performed 0:06:09 ago on Sat Jun 6 12:05:59
2015.
Installed Packages
elasticsearch.noarch 1.5.2-0.fc22
@System
rsyslog.x86_64 8.8.0-2.fc22
@System
rsyslog-elasticsearch.x86_64 8.8.0-2.fc22
@System
How reproducible:
Very.
Steps to Reproduce:
1. Install elasticsearch and rsyslog-elasticsearch. I'm using a cluster of 2
machines, but that shouldn't matter.
2. Ensure the SELinux bool nis_enabled is off. This was the case without my
intervention.
3. Configure rsylog as per the attached configuration (separate file in
/etc/rsyslog.d/)
Actual results:
AVC denials in /var/log/messages, no index created in elasticsearch.
Expected results:
Indices should be created in elasticsearch while messages are logged, AVC
should not deny rsyslog's connections, nothing noteworthy should be logged in
/var/log/messages.
Note that if rsyslog-elasticsearch is not installed, rsyslog should not be
allowed to connect to port 9200 (without nis_enabled being set), regardless of
whether elasticsearch is installed.
Additional info:
- I'm using a bare-metal cluster of 2 computers for elasticsearch, both of
which should be configured identically, courtesy of ansible.
- Elasticsearch configuration specified the network name as the host name.
- Elasticsearch configuration specifies a non-default cluster name.
- Elasticsearch uses a few ports other than 9200. I know of 9300, can't find a
documented list at the moment.
- I do have the logstash repository from
www.elastic.co setup, but should not
be using packages from it.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=C512Oqx7ra&a=cc_unsubscribe