Bug 1371201
| Summary: | [anaconda ibft] ibft plugin stopped working in 7.3 due to /sbin/iscsiadm failing. | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Radek Vykydal <rvykydal> | ||||||||||
| Component: | NetworkManager | Assignee: | Thomas Haller <thaller> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||||||||
| Severity: | high | Docs Contact: | |||||||||||
| Priority: | high | ||||||||||||
| Version: | 7.2 | CC: | aloughla, atragler, bgalvani, lrintel, mkolaja, rkhan, sukulkar, thaller, vbenes | ||||||||||
| Target Milestone: | rc | ||||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | NetworkManager-1.4.0-5.el7 | Doc Type: | If docs needed, set a value | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | |||||||||||||
| : | 1375948 (view as bug list) | Environment: | |||||||||||
| Last Closed: | 2016-11-03 19:29:14 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 1375948 | ||||||||||||
| Attachments: |
|
||||||||||||
according to manual page, err 21 means "ISCSI_ERR_NO_OBJS_FOUND - no records/targets/sessions/portals found to execute operation on." NetworkManager doesn't do much special except calling "/sbin/iscsiadm -m fw". (In reply to Radek Vykydal from comment #0) > > /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment correction: /sbin is a symlink to /usr/sbin seems to be due to CapabilityBoundingSet in NetworkManager.service. I created a test service /etc/systemd/system/test-iscsiadm.service [Unit] Description=Test iscsiadm (created by Thomas Haller, 2016-09-02) [Service] Type=oneshot ExecStart=/sbin/iscsiadm -m fw CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT ProtectSystem=true ProtectHome=read-only which fails with the present CapabilityBoundingSet. Created attachment 1197080 [details]
strace output of failure
Created with above test-service and "ExecStart=/usr/bin/strace /sbin/iscsiadm -m fw"
Created attachment 1197110 [details]
strace output of success
same, but with no CapabilityBoundingSet
seems we need CAP_SYS_ADMIN: # capsh '--drop=CAP_SYS_ADMIN' -- -c 'cat /sys/firmware/ibft/target0/flags' cat: /sys/firmware/ibft/target0/flags: Permission denied Adding CAP_SYS_ADMIN to NetworkManager.service kinda defeats the main purpose. Still, for rhel-7.2 we didn't have any restriction at all. It seems better to add the extra capability then break ibft. Created attachment 1197124 [details]
[patch] document CAP_SYS_ADMIN requirement for upstream
CapabilityBoundingSet now contains CAP_SYS_ADMIN in .service file. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2581.html |
Created attachment 1195406 [details] NetworkManager log During 7.3 development NM ibft plugin stopped being able to read iBFT info using iscsiadm: Aug 29 14:28:48 localhost NetworkManager[1431]: <debug> [1472480928.2287] ibft: failed to read iscsiadm records: iBFT: /sbin/iscsiadm exited with error 21. Message: 'iscsiadm: Could not get list of targets from firmware. (err 21) ' Attaching NM log /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment /sbin/iscsiadm -m fw works in installer environment from tty2 shell