Bug 697657

Summary: kdump throws an error if policycoreutils is missing while propagating ssh keys
Product: Red Hat Enterprise Linux 6 Reporter: Guil Barros <gbarros>
Component: kexec-toolsAssignee: Dave Young <ruyang>
Status: CLOSED ERRATA QA Contact: Cui Chun <ccui>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.0CC: ccui, cye, nhorman, phan, qcai, zhiliu
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kexec-tools-2.0.0-229.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 12:02:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed patch
none
do not depends on policycoreutils none

Description Guil Barros 2011-04-18 20:53:57 UTC
Description of problem:
kdump throws an error if policycoreutils is missing while propagating ssh keys

Version-Release number of selected component (if applicable):
kexec-tools-2.0.0-145.el6.i686

How reproducible:
every time

Steps to Reproduce:
1. do not install policycoreutils
2. configure kdump to use ssh
3. propagate ssh keys with 'service kdump propagate'
  
Actual results:
# service kdump propagate
/etc/init.d/kdump: line 281: /usr/sbin/sestatus: No such file or directory
Generating new ssh keys... done.
kdump.192.136's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~kdump/.ssh/authorized_keys on 192.168.192.136

Expected results:
# service kdump propagate
Generating new ssh keys... done.
kdump.192.136's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~kdump/.ssh/authorized_keys on 192.168.192.136

Comment 2 RHEL Program Management 2011-04-19 06:00:59 UTC
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.

Comment 6 Cong Wang 2011-08-22 10:11:58 UTC
Created attachment 519258 [details]
Proposed patch

How about this patch? :)

Comment 7 Chao Ye 2011-08-23 06:57:40 UTC
(In reply to comment #6)
> Created attachment 519258 [details]
> Proposed patch
> 
> How about this patch? :)

With patch applied:
=========================================
[root@hp-xw9300-01 SOURCES]# service kdump propagate
No ssh config specified in /etc/kdump.conf.  Can't propagate
[root@hp-xw9300-01 SOURCES]# mv /etc/kdump.conf.rpmsave /etc/kdump.conf
mv:是否覆盖"/etc/kdump.conf"? y
[root@hp-xw9300-01 SOURCES]# service kdump propagate
Generating new ssh keys... open /root/.ssh/kdump_id_rsa failed: Permission denied.
done.
/root/.ssh/kdump_id_rsa.pub failed in transfer to 10.66.12.117
[root@hp-xw9300-01 SOURCES]# rpm -q policycoreutils
package policycoreutils is not installed
[root@hp-xw9300-01 SOURCES]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Comment 8 Cong Wang 2011-08-23 10:57:56 UTC
You need to pass selinux=0 to diable selinux totally.

With selinux=0, the patch works,

[root@dell-pe800-01 ~]# rpm -q policycoreutils
package policycoreutils is not installed
[root@dell-pe800-01 ~]# service kdump propagate
Generating new ssh keys... done.
root.230.99's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~root/.ssh/authorized_keys on 10.3.230.99
[root@dell-pe800-01 ~]# touch /etc/kdump.conf 
[root@dell-pe800-01 ~]# service kdump restart
Stopping kdump:[  OK  ]
Detected change(s) the following file(s):
  
  /etc/kdump.conf
Rebuilding /boot/initrd-2.6.32-191.el6.x86_64kdump.img

Starting kdump:[  OK  ]

Comment 9 Cong Wang 2011-08-23 11:00:39 UTC
The reason is that we will not support that you have selinux enabled but policycoreutils removed, this is a broken environment that you should fix, it is not kdump's fault to detect or fix this.

Also, I want to keep the patch as simple as possible.

Comment 10 Cong Wang 2011-08-23 11:03:17 UTC
With policycoreutils installed,

[root@dell-pe800-01 ~]# yum install -y policycoreutils
...
Installed:
  policycoreutils.x86_64 0:2.0.83-19.12.el6                                     

Complete!
[root@dell-pe800-01 ~]# service kdump propagate
Using existing keys...
/root/.ssh/kdump_id_rsa.pub has been added to ~root/.ssh/authorized_keys on 10.3.230.99
[root@dell-pe800-01 ~]# touch /etc/kdump.conf 
[root@dell-pe800-01 ~]# service kdump restart
Stopping kdump:[  OK  ]
Detected change(s) the following file(s):
  
  /etc/kdump.conf
Rebuilding /boot/initrd-2.6.32-191.el6.x86_64kdump.img
Starting kdump:[  OK  ]

Comment 15 Dave Young 2012-02-28 06:35:53 UTC
Created attachment 566216 [details]
do not depends on policycoreutils

Comment 16 Dave Young 2012-02-28 06:41:09 UTC
We did not found out why we need this setenforcing things, maybe some test without these code can help us find something.

For this bug, because we just need setenforce 0 or 1, so we can directly echo the value to selinuxfs. Please check if patch in comment #15 fix your problem.

I tested it for below case:
rpm -e policycoreutils
enforce set as 1:
 service kdump propagate
enforce set as 0:
 service kdump propagate

Comment 22 errata-xmlrpc 2012-06-20 12:02:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0758.html