| Summary: | icecc-scheduler doesn't run | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ralph Giles <giles> |
| Component: | icecream | Assignee: | Michal Schmidt <mschmidt> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 25 | CC: | code, helio, mschmidt |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | icecream-1.1-0.5.rc2.ga79f70f.fc24 icecream-1.1-0.5.rc2.ga79f70f.fc25 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-23 03:53:10 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Ralph Giles
2016-10-27 22:33:37 UTC
The SELinux denial is:
avc: denied { execute } for pid=787 comm="icecc-scheduler" path="/usr/bin/bash" dev="vda1" ino=2358 scontext=system_u:system_r:icecc_scheduler_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0
This happens with kernel >= 4.8. I found this commit by git bisection:
commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46
Author: Linus Torvalds <torvalds>
Date: Mon Aug 22 16:41:46 2016 -0700
binfmt_elf: switch to new creds when switching to new mm
Before this commit SELinux did not need to allow icecc_scheduler_t to mmap shell_exec_t for execution, because the credentials of the process changed to icecc_scheduler_t only after mapping the ELF file (/usr/bin/bash).
The SIGSEGV appears probably because when the SELinux denial causes elf_map() to fail, the execing has progressed beyond the point of no return. The error path there should better kill the process with SIGKILL.
I'll adjust the SELinux policy for icecream. And I'll look into the error path in the kernel too.
Thanks for the tidy analysis! My report #1391871 for Fedora 24 isn’t an exact duplicate, is it? No, it is different. *** Bug 1392250 has been marked as a duplicate of this bug. *** icecream-1.1-0.3.rc2.ga79f70f.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-330757967d icecream-1.1-0.3.rc2.ga79f70f.fc24.1 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-39d33df0e3 icecream-1.1-0.3.rc2.ga79f70f.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-330757967d icecream-1.1-0.3.rc2.ga79f70f.fc24.1 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-39d33df0e3 icecream-1.1-0.5.rc2.ga79f70f.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-330757967d icecream-1.1-0.5.rc2.ga79f70f.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-39d33df0e3 This version works for me. Thanks! icecream-1.1-0.5.rc2.ga79f70f.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-39d33df0e3 icecream-1.1-0.5.rc2.ga79f70f.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-330757967d icecream-1.1-0.5.rc2.ga79f70f.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. icecream-1.1-0.5.rc2.ga79f70f.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report. |