Has anybody encountered this? It looks like SELinux is preventing headless registration of a RHEL system to Lightspeed aka Insights.
When booting up, invoking the insights client (in cloud-init) returns:
(PermissionError: [Errno 13] Permission denied: '/usr/bin/python3')
Using rhc, I get this message:
[𐄂] Analytics ... Cannot connect to Red Hat Lightspeed (formerly Insights)
However, I am able to register when I logged in manually.
After fussing with the boot setup, I was able to isolate the issue to SELinux by running the register in cron and monitoring the log, I see the error again:
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( run_phase(p))
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( File "/usr/lib/python3.12/site-packages/insights_client/__init__.py", line 129, in run_phase)
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( process = subprocess.Popen(insights_command, env=env))
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^)
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( File "/usr/lib64/python3.12/subprocess.py", line 1026, in __init__)
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( self._execute_child(args, executable, preexec_fn, close_fds,)
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( File "/usr/lib64/python3.12/subprocess.py", line 1955, in _execute_child)
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT ( raise child_exception_type(errno_num, err_msg, err_filename))
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDOUT (PermissionError: [Errno 13] Permission denied: '/usr/bin/python3')
Aug 31 02:45:01 rhel03 CROND[5071]: (root) CMDEND (/usr/bin/insights-client --register && rm -f /etc/cron.d/insights-register)
When I set the setenforce to 0, then I see it successfully register:
Aug 31 02:50:01 rhel03 CROND[5201]: (root) CMD (/usr/bin/insights-client --register && rm -f /etc/cron.d/insights-register)
Aug 31 02:50:01 rhel03 CROND[5200]: (root) CMDOUT (Successfully registered host rhel03.example.com)
Aug 31 02:50:02 rhel03 CROND[5200]: (root) CMDOUT (Automatic scheduling for Insights has been enabled.)
Aug 31 02:50:02 rhel03 CROND[5200]: (root) CMDOUT (Starting to collect Insights data for rhel03.example.com)
Aug 31 02:50:13 rhel03 CROND[5200]: (root) CMDOUT (Writing RHSM facts to /etc/rhsm/facts/insights-client.facts ...)
Aug 31 02:50:13 rhel03 CROND[5200]: (root) CMDOUT (Uploading Insights data.)
Aug 31 02:50:14 rhel03 CROND[5200]: (root) CMDOUT (Successfully uploaded report from rhel03.example.com to account 555555.)
Aug 31 02:50:14 rhel03 CROND[5200]: (root) CMDEND (/usr/bin/insights-client --register && rm -f /etc/cron.d/insights-register)
Right now, I worked around the issue by temporarily setting SElinux to permissive before registration:
runcmd:
- [ setenforce, 0 ]
- [ rhc, connect, --activation-key, abc, --organization, 123456 ]
- [ setenforce, 1 ]
Not ideal, but it is temporary lab I spin up on my Mac, so it works for me. Obviously, if somebody is running this in production, this can be an issue, so I want to surface this up for other people to be aware.
Incidentally, I spinning up my instances from an ARM RHEL QCOW2 image, generated from the Red Hat console.