Bug 1865762

Summary:	[RHEL][IBM] CephFS Volume has Permission Denied error while mounting
Product:	Red Hat Enterprise Linux 8	Reporter:	Humble Chirammal <hchiramm>
Component:	container-selinux	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	8.0	CC:	akgunjal, assingh, dornelas, dwalsh, ebenahar, ekuric, hchiramm, jnovy, jrivera, lvrabec, madam, mmalik, nberry, ocs-bugs, plautrba, ratamir, sabose, sostapov, ssekidde, tsweeney, uchapaga
Target Milestone:	rc
Target Release:	8.0
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1845166	Environment:
Last Closed:	2021-01-28 11:15:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1845166

Comment 1 Humble Chirammal 2020-08-04 05:00:20 UTC

To summarize:

`container_use_cephfs` SELinux boolean has to be enabled in RHEL for Ceph to work correctly in OCS + OCP deployments. Can we please enable it by default in RHEL ?

Comment 2 Milos Malik 2020-08-04 07:19:59 UTC

The selinux-policy packages shipped in RHEL do not define any container_use_cephfs boolean. I believe this bug should be switched to container-selinux component.

Comment 3 Milos Malik 2020-08-04 07:22:41 UTC

After installation of the container-selinux package on a RHEL-8.x machine, the container_use_cephfs boolean appears.

Comment 4 Lukas Vrabec 2020-08-04 07:34:50 UTC

As Milos mentioned container_use_cephfs is defined in container-selinux rpm package. 
https://github.com/containers/container-selinux/blob/master/container.te#L32

Switching component from selinux-policy to container-selinux.

Comment 6 Humble Chirammal 2020-10-05 10:44:47 UTC

(In reply to Lukas Vrabec from comment #4)
> As Milos mentioned container_use_cephfs is defined in container-selinux rpm
> package. 
> https://github.com/containers/container-selinux/blob/master/container.te#L32
> 
> Switching component from selinux-policy to container-selinux.

Thanks Milos and Lukas. considering this is hitting good number of customers, can we please prioritize this fix in container-selinux.

Comment 7 Yaniv Kaul 2020-11-30 15:39:07 UTC

(In reply to Humble Chirammal from comment #6)
> (In reply to Lukas Vrabec from comment #4)
> > As Milos mentioned container_use_cephfs is defined in container-selinux rpm
> > package. 
> > https://github.com/containers/container-selinux/blob/master/container.te#L32
> > 
> > Switching component from selinux-policy to container-selinux.
> 
> Thanks Milos and Lukas. considering this is hitting good number of
> customers, can we please prioritize this fix in container-selinux.

Any updates?

Comment 8 Daniel Walsh 2020-12-01 20:27:59 UTC

If openshift wants to enable this boolean by default, I am all for it.

I don't see a reason to enable it by default in container-selinux.

Comment 9 Tom Sweeney 2020-12-01 20:55:51 UTC

Derrick,

Given the previous comment from Dan, can/should we move this to OpenShift?  Or do you know who from that group we could get to weigh in on this thought?

Comment 10 Derrick Ornelas 2020-12-09 18:42:22 UTC

The selinux boolean is already enabled by default on RHEL CoreOS starting with OCP 4.1 (BZ 1694045). I think this bug is specifically about enabling it by default in RHEL 8.  

Humble, is this issue specific to ROKS which I believe only uses RHEL 7 and not RHCOS?  If you're using RHCOS this should just work.

Comment 11 Daniel Walsh 2021-01-28 11:15:55 UTC

This looks like it works as planned.
I am closing this as notabug

Comment 12 Red Hat Bugzilla 2023-09-15 00:46:01 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days