Bug 1217198
| Summary: | [SELinux] SELinux prevents execute access for S31ganesha-reset.sh to glusterd | ||
|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat Gluster Storage | Reporter: | Shruti Sampat <ssampat> |
| Component: | glusterd | Assignee: | Bug Updates Notification Mailing List <rhs-bugs> |
| Status: | CLOSED DUPLICATE | QA Contact: | storage-qa-internal <storage-qa-internal> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rhgs-3.1 | CC: | nlevinki, pprakash, vbellur |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-06-19 06:54:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Another error that I am seeing in the logs is -
----
time->Tue Apr 28 09:54:02 2015
type=SYSCALL msg=audit(1430214842.316:96): arch=c000003e syscall=2 success=yes exit=4 a0=250b710 a1=c2 a2=180 a3=7fff35aaa8c0 items=0 ppid=16998 pid=17020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sed" exe="/bin/sed" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
type=AVC msg=audit(1430214842.316:96): avc: denied { create } for pid=17020 comm="sed" name="sed6hERKA" scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:samba_etc_t:s0 tclass=file
----
We are tracking all the AVC's related to hook scripts in the following RHGS BZ: Bug 1215637 - [SELinux] [RHGS-3.1] AVC's of all the executable hooks under /var/lib/glusterd/hooks/ on RHEL-6.7 Hence marking this BZ as a duplicate. *** This bug has been marked as a duplicate of bug 1215637 *** |
Description of problem: ------------------------ I see the following AVC errors while running automated tests on RHEL 6.6 via Beaker. <snip> time->Tue Apr 28 11:35:30 2015 type=SYSCALL msg=audit(1430220930.760:245): arch=c000003e syscall=59 success=no exit=-8 a0=7f25d0008cb0 a1=7f25d0008a60 a2=c5ef10 a3=8 items=0 ppid=29524 pid=4082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="glusterd" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:glusterd_t:s0 key=(null) type=AVC msg=audit(1430220930.760:245): avc: denied { execute_no_trans } for pid=4082 comm="glusterd" path="/var/lib/glusterd/hooks/1/reset/post/S31ganesha-reset.sh" dev=dm-0 ino=522737 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file type=AVC msg=audit(1430220930.760:245): avc: denied { execute } for pid=4082 comm="glusterd" name="S31ganesha-reset.sh" dev=dm-0 ino=522737 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file ---- time->Tue Apr 28 11:35:30 2015 type=SYSCALL msg=audit(1430220930.779:246): arch=c000003e syscall=0 success=yes exit=155 a0=5 a1=3db06118c0 a2=3ff a3=0 items=0 ppid=4082 pid=4084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=unconfined_u:system_r:glusterd_t:s0 key=(null) type=AVC msg=audit(1430220930.779:246): avc: denied { sys_ptrace } for pid=4084 comm="ps" capability=19 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=unconfined_u:system_r:glusterd_t:s0 tclass=capability Fail: AVC messages found. Checking for errors... Using stronger AVC checks. Define empty RHTS_OPTION_STRONGER_AVC parameter if this causes any problems. Running 'cat /mnt/testarea/tmp.rhts-db-submit-result.ZrfFAZ | /sbin/ausearch -m AVC -m SELINUX_ERR' Fail: AVC messages found. Running 'cat %s | /sbin/ausearch -m USER_AVC >/mnt/testarea/tmp.rhts-db-submit-result.z5f4z9 2>&1' Info: No AVC messages found. /bin/grep 'avc: ' /mnt/testarea/dmesg.log | /bin/grep --invert-match TESTOUT.log No AVC messages found in dmesg Running '/usr/sbin/sestatus' SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted Running 'rpm -q selinux-policy || true' selinux-policy-3.7.19-260.el6.noarch </snip> Version-Release number of selected component (if applicable): -------------------------------------------------------------- I am using upstream nightly builds of glusterfs from here - http://download.gluster.org/pub/gluster/glusterfs/nightly/glusterfs-3.7/epel-6-x86_64/ How reproducible: ------------------ Saw it once in my automated test runs. Steps to Reproduce: -------------------- Running AFR self-heal automated tests on RHEL 6.6 I can provide detailed steps by looking at the tests, but this will take some time. Actual results: --------------- Found AVC errors as shown above. Expected results: ------------------ AVC errors not expected. Additional info: ----------------- Unfortunately I have lost access to these machines as they were automatically returned to Beaker after the tests ran. The logs that I am referring to are here - http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2015/04/9430/943074/1943011/30157567/148964209/test_log-SELF-HEAL-TEST-237783-avc.log The Beaker job can be accessed here - https://beaker.engineering.redhat.com/jobs/943074