Bug 1168962
| Summary: | gssproxy is not working with httpd on ppc64 and s390x | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Patrik Kis <pkis> | ||||||||
| Component: | gssproxy | Assignee: | Simo Sorce <ssorce> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | 7.1 | CC: | dpal, eguan, jpazdziora, ksiddiqu, pkis | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | gssproxy-0.4.1-2.el7 | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2015-11-19 09:30:30 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Patrik Kis
2014-11-28 14:37:56 UTC
Can you please check the audit log ? I think this is probably a duplicate for bz1008777 (In reply to Simo Sorce from comment #1) > Can you please check the audit log ? > I think this is probably a duplicate for bz1008777 I don't think is is duplicate of bz1008777. Note that in this case the test were executed with selinux in permissive mode and it worked only on x86_64 and ppc64le. On s390x, for example, in permissive mode the web server still responded with "500 Internal Server Error". Audit log shows the well known denial: ---- time->Thu Dec 11 03:14:16 2014 type=SYSCALL msg=audit(1418285656.865:982579): arch=80000016 syscall=5 success=yes exit=11 a0=3fff000abc0 a1=2c1 a2=180 a3=3fff4b98a18 items=0 ppid=1 pid=56509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gssproxy" exe="/usr/sbin/gssproxy" subj=system_u:system_r:gssproxy_t:s0 key=(null) type=AVC msg=audit(1418285656.865:982579): avc: denied { create } for pid=56509 comm="gssproxy" name="HTTP_0" scontext=system_u:system_r:gssproxy_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file but it was only logged this time (note: success=yes), so there must be a problem somewhere else too which seems to be ppc64 and s390x related. Ok then I need a s390x or ppc64 machine with development tool (debuginfo/gdb) installed to log in and see what is going on. There may be some subtle endianess bug somewhere I guess. Created attachment 969156 [details]
Patch that fixes a cast error that break S390 and alike
Can you check if this patch fixes the issue for you ?
Ah btw I added this to the HTTP service definition: cred_store = rcache:none:none This avoids selinux denials. (In reply to Simo Sorce from comment #5) > Created attachment 969156 [details] > Patch that fixes a cast error that break S390 and alike > > Can you check if this patch fixes the issue for you ? You want the line + size_t cypherlen; to read + size_t cipherlen; or the code won't compile. I confirm that with the fixed patch things start to work on a s390x machine. arghh, how did it compile for me ? ... updating patch, but thanks fo confirming. Created attachment 969676 [details]
fixed patch, for reference
Patrik, do you need a scratch build to test this ? (In reply to Simo Sorce from comment #10) > Patrik, > do you need a scratch build to test this ? No thanks, the issue is not that urgent for me. Jan confirmed that the patch is working. But if you want to test it once more, create the build and I can run my auto test on it. Upstream ticket: https://fedorahosted.org/gss-proxy/ticket/146 Taking bug myself... Fixed in gssproxy-0.4.1-2.el7 ... ... marking bug as MODIFIED. Verified. [root@ibm-p730-06-lp1 ~]# rpm -q gssproxy mod_auth_kerb ipa-client gssproxy-0.4.1-3.el7.ppc64 mod_auth_kerb-5.4-28.el7.ppc64 ipa-client-4.2.0-3.el7.ppc64 [root@ibm-p730-06-lp1 ~]# and [root@ibm-z10-05 ~]# rpm -q gssproxy mod_auth_kerb ipa-client gssproxy-0.4.1-3.el7.s390x mod_auth_kerb-5.4-28.el7.s390x ipa-client-4.2.0-3.el7.s390x [root@ibm-z10-05 ~]# Please find the attached console output of verification steps taken. Created attachment 1062477 [details]
console output with verification steps
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2298.html |