Bug 1607798

This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.

Reopening for reconsideration, on behalf of CEE Product Experience. 

This needs to be fixed in RHEL 7.  The RHEL High Availability Add-On offers the fence_mpath agent for users to select as a method to manage the membership state of nodes of their cluster.  The SELinux denials here prevent that agent from performing its duties - and this leaves those cluster deployments at risk of not providing High Availability for their configured use case.  And in most cases - this will only be discovered in production, as the same functionality won't be triggered during "normal" operations - only when the cluster is in a critical state requiring recovery operations to be carried out against a node.  

The point is: This presents a risk for customers to lose access to mission critical services which is counter to the purpose of RHEL High Availability.  The functionality that is blocked by this set of SELinux denials is already in customers hands, so we need SELinux to allow it.  

It is unfortunate that the SELinux changes were not made at the same time as the user-functionality that was delivered, but we still need to deliver those policy changes to avoid the fallout with customers.  We are already having to take special proactive measures to get out ahead of this with customers, and we need to deliver a fix so this isn't broken for the life of RHEL 7.  

Can we please reevaluate the 7.7 decision?  Is there something we in CEE Global Support can help with to verify this and/or move it forward? 

Thanks,
John Ruemker
CEE Product Experience lead for RHEL High Availability

I'm fine with giving qa_ack+ to this bug, if QE person responsible for testing of fence-agents-mpath helps me to test the mpathpersist functionality.

I expect that /usr/sbin/mpathpersist gets some FS administration related label (like fsadm_t or lvm_t instead of bin_t) and a transition from watchdog_t to the FS administration related domain gets defined.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2127