Re: [HTCondor-users] Installing HTCondor on Centos 7. SECMAN errors on startup

[Thomas Taylor <thomas.taylor@xxxxxxxxx>]

FYI. Problem Solved.Â

It appears to be a problem with CentOS 7's use of SELinux. After disabling selinux and rebooting the machine, condor appears to be working. The SELinux condor policy doesn't appear to allow condor_collector to bind to a random port.

Thomas

# /var/log/audit/audit.log

# Showing condor_collector DENIED

#

# ausearch -c condor

#

time->Thu May 21 13:21:34 2015

type=SYSCALL msg=audit(1432228894.194:3296): arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=172f388 a2=10 a3=0 items=0 ppid=1817 pid=1819 auid=4294967295 uid=0 gid=0 euid=996 suid=0 fsuid=996 egid=994 sgid=0 fsgid=994 tty=(none) ses=4294967295 comm="condor_collecto" exe="/usr/sbin/condor_collector" subj=system_u:system_r:condor_collector_t:s0 key=(null)

type=AVC msg=audit(1432228894.194:3296): avc: Âdenied Â{ name_connect } for Âpid=1819 comm="condor_collecto" dest=50346 scontext=system_u:system_r:condor_collector_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket

# SELinux shows that the Condor module is installed

#

# semodule -l | grep condor

#

condor 1.0.1

#

# sestatus

#

SELinux status: Â Â Â Â Â Â Â Â enabled

Current mode: Â Â Â Â Â Â Â Â Â enforcing

/etc/selinux/config

SELINUX: disabled

** reboot **

#

# sestatus

#

SELinux status: Â Â Â Â Â Â Â Â disabled

#

# condor_status

#

Name        OpSys   ÂArch  State   Activity LoadAv Mem  ActvtyTime

slot1@localhost. LINUX   ÂX86_64 Unclaimed Idle   Â0.300 Â996 Â0+00:00:04

slot2@localhost. LINUX   ÂX86_64 Unclaimed Idle   Â0.000 Â996 Â0+00:00:27

          ÂMachines Owner Claimed Unclaimed Matched Preempting

    X86_64/LINUX    Â2   0    0     2    0     Â0

       ÂTotal    Â2   0    0     2    0     Â0