Bug 1440165

Summary:	SELinux policy (daemons) changes required for package: sbd - due to enabling block-device support
Product:	Red Hat Enterprise Linux 7	Reporter:	Klaus Wenninger <kwenning>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.4	CC:	cfeist, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-142.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 15:24:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Klaus Wenninger 2017-04-07 12:38:09 UTC

Description of problem:

Since block-device-support has been enabled in sbd for RHEL-7.4
selinux seems to prevent sbd from accessing the block-device
configured.

Version-Release number of selected component (if applicable):


How reproducible:

100%

Steps to Reproduce:
1. enable block-device-support in an sbd-setup (e.g. set SBD_DEVICE in /etc/sysconfig/sbd)
2. restart sbd-service
3.

Actual results:

Apr 07 12:26:27 rhel73-node1 sbd[17128]:  warning: open_device: Opening
device /dev/vdb failed.

Expected results:

No moaning in logs + smooth operation

Additional info:

running the system in permissive mode sbd doesn't complain

Comment 2 Milos Malik 2017-04-07 13:21:21 UTC

# rpm -qa selinux-policy\*
selinux-policy-targeted-3.13.1-136.el7.noarch
selinux-policy-3.13.1-136.el7.noarch
# grep ^SBD_DEVICE /etc/sysconfig/sbd 
SBD_DEVICE="/dev/vda"
#

Following SELinux denial appeared in enforcing mode:
----
type=SYSCALL msg=audit(04/07/2017 09:15:04.197:491) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x10d90a0 a1=O_RDWR|O_DSYNC|O_DIRECT|__O_SYNC a2=0x10f0c30 a3=0x8 items=0 ppid=1 pid=22710 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sbd exe=/usr/sbin/sbd subj=system_u:system_r:sbd_t:s0 key=(null) 
type=AVC msg=audit(04/07/2017 09:15:04.197:491) : avc:  denied  { read write } for  pid=22710 comm=sbd name=vda dev="devtmpfs" ino=8263 scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file 
----

Following SELinux denials appeared in permissive mode:
----
type=SYSCALL msg=audit(04/07/2017 09:18:07.917:668) : arch=x86_64 syscall=open success=yes exit=4 a0=0x25160a0 a1=O_RDWR|O_DSYNC|O_DIRECT|__O_SYNC a2=0x252dc30 a3=0x8 items=0 ppid=1 pid=24583 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sbd exe=/usr/sbin/sbd subj=system_u:system_r:sbd_t:s0 key=(null) 
type=AVC msg=audit(04/07/2017 09:18:07.917:668) : avc:  denied  { open } for  pid=24583 comm=sbd path=/dev/vda dev="devtmpfs" ino=8263 scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file 
type=AVC msg=audit(04/07/2017 09:18:07.917:668) : avc:  denied  { read write } for  pid=24583 comm=sbd name=vda dev="devtmpfs" ino=8263 scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file 
----
type=SYSCALL msg=audit(04/07/2017 09:18:07.917:669) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x4 a1=0x1268 a2=0x61054c a3=0x7ffc6246b9a0 items=0 ppid=1 pid=24583 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sbd exe=/usr/sbin/sbd subj=system_u:system_r:sbd_t:s0 key=(null) 
type=AVC msg=audit(04/07/2017 09:18:07.917:669) : avc:  denied  { ioctl } for  pid=24583 comm=sbd path=/dev/vda dev="devtmpfs" ino=8263 scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file 
----

Comment 8 errata-xmlrpc 2017-08-01 15:24:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861