| Summary: | watchdog.d and fence_mpath python script | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Juricek <mjuricek> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.6 | CC: | ctowsley, jruemker, lvrabec, mgrac, mjuricek, mmalik, plautrba, pvrabec, ssekidde, tjaros, zpytela |
| Target Milestone: | rc | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1293384 | Environment: | |
| Last Closed: | 2019-08-06 12:52:25 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 1255020, 1293384 | ||
| Bug Blocks: | 1292071 | ||
|
Comment 3
Zdenek Pytela
2019-02-28 19:27:52 UTC
Reopening for reconsideration, on behalf of CEE Product Experience. This needs to be fixed in RHEL 7. The RHEL High Availability Add-On offers the fence_mpath agent for users to select as a method to manage the membership state of nodes of their cluster. The SELinux denials here prevent that agent from performing its duties - and this leaves those cluster deployments at risk of not providing High Availability for their configured use case. And in most cases - this will only be discovered in production, as the same functionality won't be triggered during "normal" operations - only when the cluster is in a critical state requiring recovery operations to be carried out against a node. The point is: This presents a risk for customers to lose access to mission critical services which is counter to the purpose of RHEL High Availability. The functionality that is blocked by this set of SELinux denials is already in customers hands, so we need SELinux to allow it. It is unfortunate that the SELinux changes were not made at the same time as the user-functionality that was delivered, but we still need to deliver those policy changes to avoid the fallout with customers. We are already having to take special proactive measures to get out ahead of this with customers, and we need to deliver a fix so this isn't broken for the life of RHEL 7. Can we please reevaluate the 7.7 decision? Is there something we in CEE Global Support can help with to verify this and/or move it forward? Thanks, John Ruemker CEE Product Experience lead for RHEL High Availability I'm fine with giving qa_ack+ to this bug, if QE person responsible for testing of fence-agents-mpath helps me to test the mpathpersist functionality. I expect that /usr/sbin/mpathpersist gets some FS administration related label (like fsadm_t or lvm_t instead of bin_t) and a transition from watchdog_t to the FS administration related domain gets defined. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2127 |