Bug 1558656
| Summary: | SELinux is preventing /usr/sbin/snapperd from mounton access [rhel-7.5.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | Mirek Jahoda <mjahoda> |
| Priority: | high | ||
| Version: | 7.5 | CC: | jkrysl, lkocman, lmiksik, lvrabec, mgrepl, mjahoda, mmalik, okozina, plautrba, salmy, ssekidde |
| Target Milestone: | rc | Keywords: | Regression, ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-192.el7_5.2 | Doc Type: | Bug Fix |
| Doc Text: |
Previously, rules for the Snapper module were missing in the SELinux policy. As a consequence, the snapperd daemon was not able to create snapshots and it was not able to work properly in general. With this update, the missing rules have been added to the selinux-policy packages, and snapperd now works correctly with SELinux in enforcing mode.
|
Story Points: | --- |
| Clone Of: | 1556798 | Environment: | |
| Last Closed: | 2018-04-10 19:14:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1556798 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-03-20 17:27:03 UTC
Our automated TC for snapper passes on x86_64 VM 1MT-RHEL-7.5-20180315.0 if the latest selinux-policy (3.13.1-192.el7_5.1) installed. Could you re-run your snapper tests and let us know, what are their results. The same SELinux denial as mentioned in comment#7 we already saw in BZ#1063150. Our TC found out that following rules are missing: allow snapperd_t kernel_t : process { setsched }; allow snapperd_t fs_t : filesystem { mount }; The reason for switching this bug to ASSIGNED is that both rules should be present, but they are not. BZ#1063150 is closed as current release, therefore the rules should be present. Jakub,
Following line:
allow snapperd_t kernel_t : process { setsched };
Is allowing snapperd to set priority for kernel threads. Is to okay? Snapperd is manipulating with kernel threads prio?
THanks,
Lukas.
Lukas, I lack the knowledge to answer this properly, this is more a question for Ondrej. Jakub Snapperd is lowering priority of background tasks (threads) performing snapshot comparison. Both process priority and i/o priority are set (lowered). setpriority() syscall(SYS_ioprio_set,...) Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1059 |