Bug 1224879

$ matchpathcon /var/lib/glusterd/hooks/*/*.sh
/var/lib/glusterd/hooks/*/*.sh	system_u:object_r:bin_t:s0

Created attachment 1037555 [details]
AVC logs

I believe we have fixed most of these issues.

How does it look with the latest el7 policy?

Created attachment 1039536 [details]
heart beat related denials?

Created attachment 1039537 [details]
mount related denials

Created attachment 1039538 [details]
ctdb service related

Created attachment 1039539 [details]
ctdb service related2

Created attachment 1039540 [details]
without samba install

You should run

setsebool -P use_fusefs_home_dirs 1

to allow some of them.

I found 4 issues on performing the tests with the following selinux packages installed.

libselinux-2.2.2-6.el7.x86_64
libselinux-utils-2.2.2-6.el7.x86_64
selinux-policy-3.13.1-28.el7.noarch
libselinux-python-2.2.2-6.el7.x86_64
selinux-policy-targeted-3.13.1-28.el7.noarch


Issues are:

1. Denials on starting ctdb service. see attachments audit.log.CtdbDenials and audit.log.CtdbDenialsAfterPermissive

2. Denials on performing a smb mount. see attachment audit.log.SmbdDenialOnCifsMount

3. Denials on ctdb probably because of ctdb heartbeats. see attachment audit.log.CtdbDenialForGetattr

4. One issue which may be just because I did not install Samba and tried to start ctdb service. I did not see this denials ever after installing Samba. Probably can be ignored.
See attachment audit.log.HookScriptDenialsBeforeSambaInstall.

Does this mean we will need one more update of policy.

I added net_admin for smbd_t. 

But you will need to run

setsebool -P use_fusefs_home_dirs 1

to allow to use FUSE.

Miroslav,

Is use_fusefs_home_dirs required just for ctdb to be able to use FUSE or even for user mounts?


Any way we can automate it with? Otherwise it would mean one more step in the admin guide while setting up ctdb.

Yes, it should be turn on by default by Gluster.

setsebool -P use_fusefs_home_dirs 1

I see following AVC's on ctdb setup.

type=AVC msg=audit(06/25/2015 06:19:22.207:22288) : avc:  denied  { signull } for  pid=15386 comm=ctdbd scontext=system_u:system_r:ctdbd_t:s0 tcontext=system_u:system_r:smbd_t:s0 tclass=process 
----

type=AVC msg=audit(06/25/2015 06:19:32.566:22290) : avc:  denied  { read } for  pid=16754 comm=iptables path=/var/lib/ctdb/iptables-ctdb.flock dev="dm-0" ino=67681652 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ctdbd_var_lib_t:s0 tclass=file

commit 2bbd5489d69d888a1c05e082e756543c1f0b3c08
Author: Lukas Vrabec <lvrabec>
Date:   Tue Jun 30 14:54:15 2015 +0200

    Dontaudit ctbd_t sending signull to smbd_t.


commit 5cc206f8481d2a4b4ba7d267c3e0bf0f8203eaf8
Author: Lukas Vrabec <lvrabec>
Date:   Tue Jun 30 13:19:15 2015 +0200

    Allow iptables to read ctdbd lib files.

The AVC's mentioned in #C18 are resolved with the build 
selinux-policy-3.13.1-30.el7 , I see only AVC as follows:

type=AVC msg=audit(07/03/2015 01:30:25.839:154) : avc:  denied  { block_suspend } for  pid=31332 comm=smbd capability=block_suspend  scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:system_r:smbd_t:s0 tclass=capability2 

We need to add this as well.
All other issues and AVC's are resolved.

commit 6bb5d0038eb282cadcac82e71d3c0304d43c7b44
Author: Lukas Vrabec <lvrabec>
Date:   Thu Jul 9 13:24:07 2015 +0200

    Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
    checking if processes exists.

commit 687a1df2816c9fcc5af7f301749c8014df0815eb
Author: Lukas Vrabec <lvrabec>
Date:   Thu Jul 9 13:22:48 2015 +0200

    Dontaudit smbd_t block_suspend capability. This is kernel bug.

commit 763e30c40a7e03a46dfac511dcdde1de3e9232c6
Author: Lukas Vrabec <lvrabec>
Date:   Thu Jul 9 13:16:21 2015 +0200

    Add interfaces winbind_signull(), samba_unconfined_net_signull().

With SELinux policy build :

selinux-policy-targeted-3.13.1-32.el7.noarch
selinux-policy-3.13.1-32.el7.noarch

I am seeing following AVC's which were not seen in the earlier build.
Worked with Milos on the same and found that the rule 
allow ctdbd_t systemd_systemctl_exec_t : file { ioctl read getattr lock execute execute_no_trans open } ;  is present in .31el7 build but is missing from .32el7 build.

Could you attach AVCs?

Created attachment 1052256 [details]
AVC's

Also verified that after downgrading to .31 el7 ctdb nodes comes to OK state and no AVC's seen.

commit ce652d6c62c6d38d1dab05b862cecc863075d28c
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 15 14:01:16 2015 +0200

    Allow ctdbd_t send signull to samba_unconfined_net_t.

commit 4aea5f1b161c8e711f593cf123de3b155ba71229
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 15 14:00:39 2015 +0200

    Add samba_signull_unconfined_net()

commit 645b04ea4006f4f25f606662cdf9b526df7226e5
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 15 13:44:41 2015 +0200

    Add samba_signull_winbind()

with the build selinux-policy-3.13.1-33.el7.noarch 
selinux-policy-targeted-3.13.1-33.el7.noarch

There is no AVC seen and all ctdb nodes comes to OK state after rebooting multiple nodes.

Need 7.1.z build for this bug.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html