Bug 1051140
| Summary: | Selinux does not allow root to create heap dump of user's jboss/java gear by default | |||
|---|---|---|---|---|
| Product: | OKD | Reporter: | Timothy Williams <tiwillia> | |
| Component: | Containers | Assignee: | Abhishek Gupta <abhgupta> | |
| Status: | CLOSED WONTFIX | QA Contact: | libra bugs <libra-bugs> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 2.x | CC: | nicholas_schuetz | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1051141 (view as bug list) | Environment: | ||
| Last Closed: | 2017-05-31 18:22:11 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1051141 | |||
We apologize, however, we do not plan to address this report at this time. The majority of our active development is for the v3 version of OpenShift. If you would like for Red Hat to reconsider this decision, please reach out to your support representative. We are very sorry for any inconvenience this may cause. |
Description of problem: By default, selinux does not allow an administrator of an openshift server to create a heap dump for a customer of their gear. The customer can do it themselves when ssh'ing into their gear and running `jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>`. An administrator should be able to run ` oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>` to create the heap dump for the customer, but the following selinux denial is encountered: avc: denied { entrypoint } for pid=21533 comm="runcon" path="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.45.x86_64/bin/jmap" dev=dm-0 ino=281147 scontext=unconfined_u:system_r:openshift_t:s0:c0,c1001 tcontext=system_u:object_r:java_exec_t:s0 tclass=file How reproducible: Always Steps to Reproduce: 1. As a user, create a jboss or java gear 2. As root, attempt to create a heap dump with the following command: # oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS> Actual results: Permission Denied avc denial noted in /var/log/audit/audit.log Expected results: Heap dump created Additional info: Tested with Red Hat Enterprise Linux 6.5 and 6.4 with openshift enterprise 1.2/2.0