QA (public) » openQA Project (public)

Mentioned in the daily. This looks to be selinux related. @emiler is looking into a fix.

If we need the test to pass immediately, we can temporarily re-apply the original workaround, which is disabling SELinux for httpd_t with: assert_script_run('semanage permissive -a httpd_t');

emiler wrote in #note-6:

If we need the test to pass immediately, we can temporarily re-apply the original workaround, which is disabling SELinux for httpd_t with: assert_script_run('semanage permissive -a httpd_t');

I think that would be good.

The workaround doesn't seem to work: https://openqa.opensuse.org/tests/4981786

I tried setting both of the following options in the prepare module:

assert_script_run('semanage permissive -a httpd_t');
assert_script_run('setenforce 0');

The issue probably lies somewhere else.

emiler wrote in #note-8:

The workaround doesn't seem to work: https://openqa.opensuse.org/tests/4981786

I tried setting both of the following options in the prepare module:

assert_script_run('semanage permissive -a httpd_t');
assert_script_run('setenforce 0');

The issue probably lies somewhere else.

https://github.com/realcharmer/os-autoinst-distri-openQA/blob/d452191341b7dda6c626b9f20e7190c812581c6c/tests/install/prepare.pm#L11 is too early because https://openqa.opensuse.org/tests/4981786/modules/apparmor/steps/1/src does a reboot which undoes the changes.

If this problem is selinux related, it should work if you run the test with the current master version of os-autoinst-distri-openQA:
https://github.com/realcharmer/os-autoinst-distri-openQA/blob/master/tests/install/prepare.pm

There we set a boolean which is persistent and should survive a reboot:

    # SELinux: allow web proxy to connect to openQA backend
    assert_script_run('semanage boolean -m -1 httpd_can_network_connect');

But I don't think this is related to selinux.
When I setenforce 1 on my local system and do NOT semanage boolean -m -1 httpd_can_network_connect (or semanage boolean -m -0 httpd_can_network_connect)
I will get 502 from nginx - not 403.

I mean it could still be selinux but not the connection from nginx to openqa-webui.

dheidler wrote in #note-13:

There we set a boolean which is persistent and should survive a reboot:

    # SELinux: allow web proxy to connect to openQA backend
    assert_script_run('semanage boolean -m -1 httpd_can_network_connect');

At first I assumed Nginx would need a different/additional permission. Setting setenforce 0 does not help either. The issue comes from somewhere else.
Is it acceptable to exclude this test module for the time being, if I don't solve the issue today?

https://github.com/os-autoinst/os-autoinst-distri-openQA/pull/238

I guess we should just make sure that this works with both http://127.0.0.1 and http://[::1] as well as http://localhost.

On order to cover all addresses, meaning http://127.0.0.1, http://[::1] and http://localhost, we have to edit the default Nginx configuration. It should be simple: run sed on the config to modify the default_server option and reload Nginx. This approach is mentioned in the documentation, so it's not doing anything crazy. Consequently, we should also test all the addresses, not just one.

cross linking (as it also shows on TW snapshots): https://bugzilla.opensuse.org/show_bug.cgi?id=1240733

https://github.com/os-autoinst/os-autoinst-distri-openQA/pull/240

Actually, my change only fixes our internal tests.
The changes done in the PR are just following what's mentioned in the documentation (https://open.qa/docs/#_nginx_proxy), which is a valid approach, but this step would have to be done in other tests as well.
Perhaps a better solution would be to change the default nginx confiuration directly upstream, in particular do this: https://github.com/os-autoinst/os-autoinst-distri-openQA/pull/240/files#diff-d348c4980f5b9277fb54ad564c972f1e385994e21b1027270ea1dde689b7c8dcR31
Not sure though how/if we should change the default configuration distributed by packages, as this step has to be done after installing nginx in /etc/nginx/nginx.conf.