redhat-performance / ansible-role-deploy_exporter Goto Github PK

[jhutar@localhost ~]$ echo 'type=AVC msg=audit(1617785747.387:17516): avc:  denied  { connectto } for  pid=117397 comm="redis_exporter" path="/run/redis/redis.sock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:redis_t:s0 tclass=unix_stream_socket permissive=1' | audit2why
type=AVC msg=audit(1617785747.387:17516): avc:  denied  { connectto } for  pid=117397 comm="redis_exporter" path="/run/redis/redis.sock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:redis_t:s0 tclass=unix_stream_socket permissive=1

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

[jhutar@localhost ~]$ echo 'type=AVC msg=audit(1617785747.387:17516): avc:  denied  { connectto } for  pid=117397 comm="redis_exporter" path="/run/redis/redis.sock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:redis_t:s0 tclass=unix_stream_socket permissive=1' | audit2allow 


#============= init_t ==============
allow init_t redis_t:unix_stream_socket connectto;

  when: "ansible_facts.services['firewalld.service'] is defined and ansible_facts.services['firewalld.service'].state == 'active'"

[root@perf-scale-test1-vsi ~]# ansible localhost -m service_facts | grep -i firewalld.service -A 4
            "firewalld.service": {
                "name": "firewalld.service",
                "source": "systemd",
                "state": "running",
                "status": "enabled"