Bug 1309883
| Summary: | selinux preventing pcp dmcache metrics collection (access to dmsetup denial) | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Paul Cuzner <pcuzner> | ||||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Jan Zarsky <jzarsky> | ||||||
| Severity: | low | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | 7.2 | CC: | jzarsky, ksrot, lmiksik, lvrabec, mbenitez, mgrepl, mmalik, mprchlik, nathans, pcuzner, plautrba, pvrabec, ssekidde, tlavigne | ||||||
| Target Milestone: | rc | Keywords: | Regression | ||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | selinux-policy-3.13.1-101.el7 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: |
RHEL 7.2
selinux-policy-3.13.1-60.el7_2.3.noarch
device-mapper-1.02.107-5.el7_2.1.x86_64
pcp-3.10.6-2.el7.x86_64
pcp-pmda-dm-3.10.6-2.el7.x86_64
|
|||||||
| Last Closed: | 2016-11-04 02:43:26 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Please attach the AVCs too. SELinux policy developers would like to see which AVCs appear in enforcing mode and permissive mode. Created attachment 1128668 [details]
audit log containing the denial messages against dmsetup
see attached file - dmsetup-audit.log.tar.gz
Here are unique AVCs extracted from the attachment:
----
type=SYSCALL msg=audit(02/18/2016 21:25:07.787:2795226) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x2458a70 a1=0x7fff51406220 a2=0x7fff51406220 a3=0xd items=0 ppid=12756 pid=24944 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:25:07.787:2795226) : avc: denied { getattr } for pid=24944 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
----
type=SYSCALL msg=audit(02/18/2016 21:38:04.042:2796940) : arch=x86_64 syscall=access success=no exit=-13(Permission denied) a0=0x1d4da70 a1=X_OK a2=0x7ffc75598230 a3=0xd items=0 ppid=32486 pid=32620 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:38:04.042:2796940) : avc: denied { execute } for pid=32620 comm=sh name=dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
----
type=SYSCALL msg=audit(02/18/2016 21:38:04.042:2796941) : arch=x86_64 syscall=access success=no exit=-13(Permission denied) a0=0x1d4da70 a1=R_OK a2=0x7ffc75598230 a3=0xd items=0 ppid=32486 pid=32620 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:38:04.042:2796941) : avc: denied { read } for pid=32620 comm=sh name=dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
----
type=SYSCALL msg=audit(02/18/2016 21:46:14.409:2798788) : arch=x86_64 syscall=execve success=no exit=-13(Permission denied) a0=0x1defa70 a1=0x1deed00 a2=0x1dee0c0 a3=0x7ffef046b870 items=0 ppid=4564 pid=4718 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:46:14.409:2798788) : avc: denied { open } for pid=4718 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
----
type=SYSCALL msg=audit(02/18/2016 21:49:37.630:2799350) : arch=x86_64 syscall=execve success=no exit=-13(Permission denied) a0=0xb20a70 a1=0xb1fd00 a2=0xb1f0c0 a3=0x7ffd2944c3f0 items=0 ppid=6050 pid=6568 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:49:37.630:2799350) : avc: denied { execute_no_trans } for pid=6568 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
----
type=SYSCALL msg=audit(02/18/2016 21:57:19.534:2800521) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x7fff638839a0 a1=O_RDWR a2=0x0 a3=0x7fff63883660 items=0 ppid=9261 pid=14901 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 21:57:19.534:2800521) : avc: denied { read write } for pid=14901 comm=dmsetup name=control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
----
type=SYSCALL msg=audit(02/18/2016 22:01:28.630:2801220) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x7ffcba8ebd40 a1=O_RDWR a2=0x0 a3=0x7ffcba8eba00 items=0 ppid=16523 pid=17866 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 22:01:28.630:2801220) : avc: denied { open } for pid=17866 comm=dmsetup path=/dev/mapper/control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
----
type=SYSCALL msg=audit(02/18/2016 22:07:15.361:2802177) : arch=x86_64 syscall=ioctl success=no exit=-13(Permission denied) a0=0x5 a1=0xc138fd00 a2=0x7f86579b81e0 a3=0x7ffcf4bcf470 items=0 ppid=19270 pid=21155 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 22:07:15.361:2802177) : avc: denied { ioctl } for pid=21155 comm=dmsetup path=/dev/mapper/control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
----
type=SYSCALL msg=audit(02/18/2016 22:11:01.387:2802731) : arch=x86_64 syscall=ioctl success=no exit=-13(Permission denied) a0=0x5 a1=0xc138fd00 a2=0x7f565c70f1e0 a3=0x7ffc79222510 items=0 ppid=22666 pid=23220 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)
type=AVC msg=audit(02/18/2016 22:11:01.387:2802731) : avc: denied { sys_admin } for pid=23220 comm=dmsetup capability=sys_admin scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
----
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |
Created attachment 1128338 [details] local .te file that allows dmcache reporting to work Description of problem: I am using SSD's with lvmcache so need to use pcp's pmda to gather and report on cache effectiveness. Out of the box the dmcache report (pcp -h localhost dmcache) just returns 'no values available'. Checking the audit.log shows that selinux is blocking the pcp collector's access to the dmsetup tool - hence the 'no values...' message. Version-Release number of selected component (if applicable): see 'environment' section for list of relevant rpm versions How reproducible: I have 3 systems - all 3 were blocked in the same manner Steps to Reproduce: 1. Configure lvmcache on a rhel7.2 environment 2. install pcp, with the dm pmda (shown above) 3. attempt to use the pcp -h localhost dmcache command Actual results: collector is unable to gather and report any metrics @ Thu Feb 18 16:10:39 2016 (host gprfc085.sbu.lab.eng.bos.redhat.com) ---device--- ---%used--- ---------reads--------- --------writes--------- meta cache hit miss ratio hit miss ratio No values available No values available Expected results: collector should be able to interface with dmsetup to get the cache utilisation information After installing a local policy, this is what you should see @ Thu Feb 18 16:12:17 2016 (host gprfc085.sbu.lab.eng.bos.redhat.com) ---device--- ---%used--- ---------reads--------- --------writes--------- meta cache hit miss ratio hit miss ratio rhgs_vg1-thinpool_tdata 0.7% 9.4% ? ? ?% ? ? ?% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 0.00 0.00 0% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 0.00 0.00 0% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 1.96 0.00 50.0% Additional info: I have attached the .te that I'm using as the local policy across my systems to allow cache reporting to work.