Repository: mantl/mantl

Issue:
collectd: type/attribute docker_var_run_t (No such file or directory)
This issue is related to `Centos 7.2.1511` for all Mantl branches.

When deploying Mantl, the Ansible run fails with the following error (for all hosts):

> TASK: [collectd | authorize collectd to connect to docker] *******************\* 
> failed: [mi-control-01] => {"changed": true, "cmd": "semodule -i /tmp/collectd_docker_plugin.pp", "delta": "0:00:04.724826", "end": "2016-01-27 09:40:48.636970", "rc": 1, "start": "2016-01-27 09:40:43.912144", "warnings": []}
> stderr: libsepol.print_missing_requirements: collectd_docker_plugin's global requirements were not met: type/attribute docker_var_run_t (No such file or directory).
> libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
> semodule:  Failed!

How to reproduce:

Deploy Mantl using `CentOS-7-x86_64-GenericCloud-1511` from the official repository http://cloud.centos.org/centos/7/images/ (I tested OpenStack cloud provider only).

I haven't faced with such issue when upgrading from `CentOS 7.1.1503` to `Centos 7.2.1511`.

Debugging:

So, I created 2 environments with Terraform: one using `CentOS-7.1.1503` and another one with `Centos 7.2.1511`. Then I upgraded and rebooted all hosts in both environments with `playbooks/upgrade-packages.yml`, so all hosts became `Centos 7.2.1511`.

I started Mantl deployment. The second environment fails all the time on the 'authorize collectd' task, whereas the first one doesn't have any such problems and I'm able to finish the Mantl deployment.

Both environments use the same SELinux policies:

```
[root@mi-control-01 ~]# rpm -qa | grep selinux
libselinux-python-2.2.2-6.el7.x86_64
selinux-policy-3.13.1-60.el7.noarch
libselinux-2.2.2-6.el7.x86_64
libselinux-utils-2.2.2-6.el7.x86_64
```

But:

The 1-st one:

```
[root@mi-control-01 ~]# semodule -l | grep -w docker
docker  1.0.0

[root@mi-control-01 ~]# semanage fcontext -l | grep docker_var_run_t
/var/run/docker-client(/.*)?                       all files          system_u:object_r:docker_var_run_t:s0 
/var/run/docker\.pid                               regular file       system_u:object_r:docker_var_run_t:s0 
/var/run/docker\.sock                              socket             system_u:object_r:docker_var_run_t:s0
```

The 2-nd one:

```
[root@mi-control-01 ~]# semodule -l | grep -w docker
[root@mi-control-01 ~]#

[root@mi-control-01 ~]# semanage fcontext -l | grep docker_var_run_t
[root@mi-control-01 ~]#
```

The fix is simple: you need to pre-install the Docker SELinux policies before setting up `collectd` which uses some of those policies.

```
yum install docker-selinux
```

In the playbooks the package is already installed in the `docker` role (but it's started after the `collectd` role).

This problem might be related to https://bugzilla.redhat.com/show_bug.cgi?id=1200079 :

CentOS images, provided by cloud provider, may contain the missing package (it depends on the images build process), whereas the official CentOS images split the packages some time ago and don't contain the required policies any more (by default).

Also, I was trying to check rules in `collectd_docker_plugin.pp` and was not able to find any `collectd_docker_plugin.te` file to do that. It's unclear from where we download the policy module (we just ship it as a file with Ansible). In my opinion it should be downloaded from a verified source or we should document where to find the sources for that policy module.



Discussion:
Thanks for a really nice bug report. Can you submit a PR to make sure the order is correct?

PR #1041. I think Drone CI should have caught such issue because deployment fails on a very early stage.


Resolving patch:
diff --git a/roles/docker/files/dockerplugin.py b/roles/collectd/files/dockerplugin.py
similarity index 100%
rename from roles/docker/files/dockerplugin.py
rename to roles/collectd/files/dockerplugin.py


Test patch: