| Summary: | SELinux prevents rhsmcertd-worker from accessing a lock | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Stef Walter <stefw> |
| Component: | rhel-server-atomic | Assignee: | Colin Walters <walters> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | dwalsh, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, stefw, walters |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-08-19 21:31:48 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
This bug was discovered by the Cockpit integration tests. https://fedorapeople.org/groups/cockpit/logs/pull-3456-3041953a-rhel-atomic/ Cockpit will be ignoring this message in the integration tests from here on out: https://github.com/cockpit-project/cockpit/pull/3492 It looks /var/lib/rpm is mislabeled on Atomic Hosts. What does $ ls -dZ /var/lib/rpm ? # ls -dZ /var/lib/rpm lrwxrwxrwx. root root system_u:object_r:rpm_var_lib_t:s0 /var/lib/rpm -> ../../usr/share/rpm # ls -dZ /usr/share/rpm drwxr-xr-x. root root system_u:object_r:usr_t:s0 /usr/share/rpm Hopefully this is fixed. The file contexts are still identical to those above:
-bash-4.2# ls -dZ /var/lib/rpm
lrwxrwxrwx. root root system_u:object_r:rpm_var_lib_t:s0 /var/lib/rpm -> ../../usr/share/rpm
-bash-4.2# ls -dZ /usr/share/rpm
drwxr-xr-x. root root system_u:object_r:usr_t:s0 /usr/share/rpm
-bash-4.2# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.2.6 (2016-07-29 19:54:25)
Commit: b672bf8a457cb28e003dee20c53749636ef5fce3e4743afe4aaad269d3aaa62a
OSName: rhel-atomic-host
Removing the workaround in Cockpit so we can get proof either way:
https://github.com/cockpit-project/cockpit/pull/4918
|
Description of problem: type=1400 audit(1452883155.324:7): avc: denied { write } for pid=2704 comm="rhsmcertd-worke" name=".dbenv.lock" dev="dm-0" ino=8979114 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file This happens intermittently on RHEL Atomic Host during the Cockpit integration tests. This seems to happen shortly after mounting a container: Jan 15 18:39:14 localhost.localdomain.localdomain docker[1910]: time="2016-01-15T18:39:14.951350343Z" level=info msg="POST /v1.20/containers/create" Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Unmounting Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Unmounting Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain docker[1910]: time="2016-01-15T18:39:15.301390405Z" level=info msg="POST /v1.20/containers/a79b8a26fa7f4533af6ac7b6456d032dcf02474b6003e1a2d052f716b8e43389/start" Jan 15 18:39:15 localhost.localdomain.localdomain kernel: type=1400 audit(1452883155.324:7): avc: denied { write } for pid=2704 comm="rhsmcertd-worke" name=".dbenv.lock" dev="dm-0" ino=8979114 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Versions: selinux-policy-targeted-3.13.1-60.el7.noarch subscription-manager-1.15.9-15.el7.x86_64 # atomic host status TIMESTAMP (UTC) VERSION ID OSNAME REFSPEC * 2015-12-03 19:40:36 7.2.1 aaf67b91fa rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard 2015-11-10 16:11:46 7.2 ec85fba1bf rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard