Bug 1276568

Summary:	Selinux/Appamor should be disabled for generation librbd traces
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Tanay Ganguly <tganguly>
Component:	Documentation	Assignee:	ceph-docs <ceph-docs>
Status:	CLOSED CURRENTRELEASE	QA Contact:	ceph-qe-bugs <ceph-qe-bugs>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	1.3.1	CC:	bancinco, jdillama, kdreyer, kurs, ngoswami
Target Milestone:	rc
Target Release:	1.3.1
Hardware:	x86_64
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-12-18 09:59:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tanay Ganguly 2015-10-30 07:34:17 UTC

Description of problem:
Selinux/Appamor should be disabled for generation librbd traces for RHEL/Ubuntu respectively.

Version-Release number of selected component (if applicable):
1.3.1

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
For generating librbd traces using rbd-replay, we must disable selinux/appamor in the system

Expected results:


Additional info:
We should specify to disable selinux/appamor as a prerequisite.

Document Link:
https://access.redhat.com/articles/1605163#

Comment 5 Ken Dreyer (Red Hat) 2015-10-30 15:11:28 UTC

Jason, SELinux needs to be disabled on any node that uses librbd, right? In other words, it should be disabled on all qemu hypervisors that use librbd?

(Sorry I don't have rights to view https://access.redhat.com/articles/1605163 so I can't confirm whether this covers all qemu usage or not)

Comment 6 Jason Dillaman 2015-10-30 15:16:37 UTC

I would hesitate to say SElinux / AppArmor need to be disabled for this to work.  The more nuanced answer is that SElinux / AppArmor profiles should be disabled / set to permissive for the QEMU process.  Another approach is to build a custom profile that permits the access (e.g. using audit2allow for SElinux).

Comment 8 Jason Dillaman 2015-11-02 13:53:45 UTC

Sounds better to me.

Comment 9 Tanay Ganguly 2015-11-04 06:01:18 UTC

Sounds good to me as well.

Marking it Verified.

Comment 10 Anjana Suparna Sriram 2015-12-18 09:59:32 UTC

Fixed for 1.3.1 Release.