Bug 1015819

After the latest selinux-policy I cannot start glusterd.

Attempting to start the service results in an infinite loop that fills the server logs with denials. I have to kill glusterd in order to prevent the hard disk from filling up.

GlusterFS is a Red Hat technology. SELinux is a Red Hat technology. It's obvious no one at Red Hat is running with SELinux enabled. Please get your GlusterFS team on the same page.

/var/log/messages:
Oct  5 15:29:23 balthasar setroubleshoot: SELinux is preventing /usr/sbin/glusterfsd from name_bind access on the tcp_socket . For complete SELinux messages. run sealert -l b25d7d98-c628-44d2-899d-c22b3bd3fe67

[michael@balthasar ~]$ sudo sealert -l b25d7d98-c628-44d2-899d-c22b3bd3fe67
SELinux is preventing /usr/sbin/glusterfsd from name_bind access on the tcp_socket .

*****  Plugin bind_ports (92.2 confidence) suggests  *************************

If you want to allow /usr/sbin/glusterfsd to bind to network port 1957
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 1957
    where PORT_TYPE is one of the following: agentx_port_t, apertus_ldp_port_t, audit_port_t, auth_port_t, bgp_port_t, chronyd_port_t, comsat_port_t, dhcpc_port_t, dhcpd_port_t, dns_port_t, echo_port_t, efs_port_t, epmap_port_t, fingerd_port_t, flash_port_t, ftp_data_port_t, ftp_port_t, gluster_port_t, gopher_port_t, hi_reserved_port_t, http_port_t, inetd_child_port_t, innd_port_t, ipmi_port_t, ipp_port_t, isakmp_port_t, kerberos_admin_port_t, kerberos_password_port_t, kerberos_port_t, kprop_port_t, ktalkd_port_t, ldap_port_t, lmtp_port_t, mountd_port_t, nfs_port_t, nmbd_port_t, ntp_port_t, openshift_port_t, pop_port_t, portmap_port_t, printer_port_t, reserved_port_t, rlogin_port_t, rlogind_port_t, rndc_port_t, router_port_t, rsh_port_t, rsync_port_t, rtsp_port_t, rwho_port_t, smbd_port_t, smtp_port_t, snmp_port_t, spamd_port_t, ssh_port_t, svrloc_port_t, swat_port_t, syslogd_port_t, telnetd_port_t, tftp_port_t, time_port_t, uucpd_port_t, whois_port_t, xdmcp_port_t, zarafa_port_t.

*****  Plugin catchall_boolean (7.83 confidence) suggests  *******************

If you want to allow system to run with NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
You can read 'None' man page for more details.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (1.41 confidence) suggests  ***************************

If you believe that glusterfsd should be allowed name_bind access on the  tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep glusterd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:glusterd_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                 [ tcp_socket ]
Source                        glusterd
Source Path                   /usr/sbin/glusterfsd
Port                          1957
Host                          balthasar.cchtml.com
Source RPM Packages           glusterfs-3.4.0-8.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-74.8.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     balthasar.cchtml.com
Platform                      Linux balthasar.cchtml.com 3.11.2-201.fc19.x86_64
                              #1 SMP Fri Sep 27 19:20:55 UTC 2013 x86_64 x86_64
Alert Count                   340
First Seen                    2013-09-30 11:38:10 CDT
Last Seen                     2013-10-05 14:22:58 CDT
Local ID                      b25d7d98-c628-44d2-899d-c22b3bd3fe67

Raw Audit Messages
type=AVC msg=audit(1381000978.786:999): avc:  denied  { name_bind } for  pid=1368 comm="glusterd" src=1957 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1381000978.786:999): arch=x86_64 syscall=bind success=no exit=EACCES a0=6 a1=7f69d6543960 a2=10 a3=1 items=0 ppid=1 pid=1368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=glusterd exe=/usr/sbin/glusterfsd subj=system_u:system_r:glusterd_t:s0 key=(null)

Hash: glusterd,glusterd_t,unreserved_port_t,tcp_socket,name_bind