Bug 2456191
| Summary: | SELinux blocks calls from drbd utils to /dev/proc | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Luca Cavana <luca.cavana> |
| Component: | drbd | Assignee: | Peter Hanecak <hany> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 43 | CC: | dwalsh, hany, luca.cavana, lvrabec, mmalik, omosnacek, pkoncity, plautrba, vascom2, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | drbd-9.34.0-2.fc44 drbd-9.34.0-2.fc43 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-08-24 00:41:14 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The following macro needs to be added: kernel_read_network_state(drbd_t) if the usage is legitimate. FEDORA-2026-54d715654d (drbd-9.34.0-2.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-54d715654d FEDORA-2026-73c5271fe9 (drbd-9.34.0-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-73c5271fe9 FEDORA-2026-73c5271fe9 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-73c5271fe9` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-73c5271fe9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-54d715654d has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-54d715654d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-54d715654d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. Thanks for the bump of the package, but it does not resolve this issue.
In pacemaker.log there is exactly the same error message:
Aug 17 12:51:55.264 itmil01pnfs02.corp.cavanasystems.com pacemaker-execd [1293] (log_execute) info: executing - rsc:nfs_data_drbd action:notify call_id:91
Aug 17 12:51:55 drbd(nfs_data_drbd)[30594]: ERROR: nfs_data: Called drbdadm -c /etc/drbd.conf -v adjust nfs_data
Aug 17 12:51:55 drbd(nfs_data_drbd)[30594]: ERROR: nfs_data: Exit code 10
Aug 17 12:51:55 drbd(nfs_data_drbd)[30594]: ERROR: nfs_data: Command output:
Aug 17 12:51:55 drbd(nfs_data_drbd)[30594]: ERROR: nfs_data: Command stderr: open of /proc/net/if_inet6 failed:: Permission denied
/etc/drbd.d/nfs_data.res: in resource nfs_data, on itmil01pnfs02.corp.cavanasystems.com:
IP fd71:cd3c:1f08:0::2 not found on this host.
Of course the IP is there on ens19, the drbd replication network:
$ ip address show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: ens18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether bc:24:11:27:82:5f brd ff:ff:ff:ff:ff:ff
altname enp6s18
altname enxbc241127825f
inet 10.88.18.11/24 brd 10.88.18.255 scope global noprefixroute ens18
valid_lft forever preferred_lft forever
inet6 2001:67c:d68:83::11/64 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::be24:11ff:fe27:825f/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether bc:24:11:83:02:5f brd ff:ff:ff:ff:ff:ff
altname enp6s19
altname enxbc241183025f
inet6 fd71:cd3c:1f08::2/64 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::b2d7:98ac:83fb:ac5d/64 scope link noprefixroute
valid_lft forever preferred_lft forever
... It' still SELinux to deny the call (and some others):
type=AVC msg=audit(1786963914.946:1116): avc: denied { write } for pid=30452 comm="crm_resource" name="pacemaker.log" dev="dm-0" ino=17621507 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:cluster_var_log_t:s0 tclass=file permissive=0
type=AVC msg=audit(1786963915.175:1117): avc: denied { read } for pid=30541 comm="drbdadm" name="net" dev="proc" ino=4026531843 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(1786963915.208:1118): avc: denied { read } for pid=30566 comm="drbdadm" name="net" dev="proc" ino=4026531843 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(1786963915.249:1119): avc: denied { write } for pid=30592 comm="crm_attribute" name="pacemaker.log" dev="dm-0" ino=17621507 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:cluster_var_log_t:s0 tclass=file permissive=0
type=AVC msg=audit(1786963915.314:1120): avc: denied { write } for pid=30626 comm="crm_resource" name="pacemaker.log" dev="dm-0" ino=17621507 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:cluster_var_log_t:s0 tclass=file permissive=0
type=AVC msg=audit(1786963915.326:1121): avc: denied { read } for pid=30631 comm="drbdadm" name="net" dev="proc" ino=4026531843 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(1786963915.405:1122): avc: denied { write } for pid=30683 comm="crm_attribute" name="pacemaker.log" dev="dm-0" ino=17621507 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:cluster_var_log_t:s0 tclass=file permissive=0
FEDORA-2026-73c5271fe9 (drbd-9.34.0-2.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2026-54d715654d (drbd-9.34.0-2.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: SELinux is blocking some read / open / getattr calls from drbd usespace utilities, and this makes Pacemaker cluster fails when deployed to IPv6 networks. Version-Release number of selected component (if applicable): $ sudo dnf list --installed | grep -e drbd -e pacemaker drbd.x86_64 9.34.0-1.fc43 updates drbd-bash-completion.noarch 9.34.0-1.fc43 updates drbd-pacemaker.noarch 9.34.0-1.fc43 updates drbd-selinux.noarch 9.34.0-1.fc43 updates drbd-udev.noarch 9.34.0-1.fc43 updates drbd-utils.x86_64 9.34.0-1.fc43 updates pacemaker.x86_64 3.0.1-12.fc43 updates pacemaker-cli.x86_64 3.0.1-12.fc43 updates pacemaker-cluster-libs.x86_64 3.0.1-12.fc43 updates pacemaker-libs.x86_64 3.0.1-12.fc43 updates pacemaker-schemas.noarch 3.0.1-12.fc43 updates modinfo drbd | grep version version: 9.3.1 srcversion: A0701FFF4E4C69A56628A3D How reproducible: Always Steps to Reproduce: 1. Create a cluster with pacemaker and drbd. 2. At pacemaker service shutdown, the drbd resource agents disconnects and detaches from the managed volumes. 3. At pacemaker service restart, it cannot call drbdadm -c /etc/drbd.conf -v adjust resource as it is blocked by SELinux. Actual results: The node cannot return to service. Expected results: The node does return to service by reattaching to it's drbd volumes. Additional info: The exact error from pacemakerd is: Apr 07 21:22:41 itmil01tnfs02.corp.cavanasystems.com drbd(nfs_data_drbd)[2601]: ERROR: nfs_data: Called drbdadm -c /etc/drbd.conf -v adjust nfs_data Apr 07 21:22:41 itmil01tnfs02.corp.cavanasystems.com drbd(nfs_data_drbd)[2605]: ERROR: nfs_data: Exit code 10 Apr 07 21:22:41 itmil01tnfs02.corp.cavanasystems.com drbd(nfs_data_drbd)[2613]: ERROR: nfs_data: Command stderr: open of /proc/net/if_inet6 failed:: Permission denied /etc/drbd.d/nfs_data.res: in resource nfs_data, on itmil01tnfs02.corp.cavanasystems.com: IP fd71:cd3c:1f08:0::2 not found on this host. In /var/log/messages we can see the SELinux denials: Apr 7 21:34:23 itmil01tnfs02 audit[12540]: AVC avc: denied { read } for pid=12540 comm="drbdadm" name="net" dev="proc" ino=4026531843 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=1 Apr 7 21:34:23 itmil01tnfs02 audit[12540]: AVC avc: denied { read } for pid=12540 comm="drbdadm" name="if_inet6" dev="proc" ino=4026532266 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=1 Apr 7 21:34:23 itmil01tnfs02 audit[12540]: AVC avc: denied { open } for pid=12540 comm="drbdadm" path="/proc/12540/net/if_inet6" dev="proc" ino=4026532266 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=1 Apr 7 21:34:23 itmil01tnfs02 audit[12540]: AVC avc: denied { getattr } for pid=12540 comm="drbdadm" path="/proc/12540/net/if_inet6" dev="proc" ino=4026532266 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=1 Apr 7 21:34:56 itmil01tnfs02 audit[13233]: AVC avc: denied { read } for pid=13233 comm="drbdsetup" name="net" dev="proc" ino=4026531843 scontext=system_u:system_r:drbd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=1