Bug 906684

cat'ing those two lines into "audit2allow -r" suggests the following.  I don't think this is OpenShift related so I'm going to search BZ for an upstream bug.

require {
        type cgred_t;
        type inotifyfs_t;
        class dir read;
}

#============= cgred_t ==============
allow cgred_t inotifyfs_t:dir read;

Are you getting only these AVC msgs?


Could you execute

# setenforce 0

re-test it

# ps -eZ |grep initrc

# ausearch -m avc -ts recent

# setenforce 1

[root@node ~]# setenforce 0
[root@node ~]# ps -eZ |grep initrc
system_u:system_r:openshift_initrc_t:s0-s0:c0.c1023 1496 ? 00:06:12 ruby
system_u:system_r:openshift_initrc_t:s0-s0:c0.c1023 15360 ? 00:00:00 sh <defunct>
system_u:system_r:openshift_initrc_t:s0-s0:c0.c1023 21723 ? 00:00:00 haproxy
[root@node ~]# ausearch -m avc -ts recent
----
time->Mon Feb  4 06:47:06 2013
type=SYSCALL msg=audit(1359978426.667:16668336): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fff71f2c000 a2=400 a3=0 items=0 ppid=1 pid=1367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe=2F7362696E2F636772756C6573656E6764202864656C6574656429 subj=system_u:system_r:cgred_t:s0 key=(null)
type=AVC msg=audit(1359978426.667:16668336): avc:  denied  { read } for  pid=1367 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
----
time->Mon Feb  4 06:47:06 2013
type=SYSCALL msg=audit(1359978426.667:16668337): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fff71f2c000 a2=400 a3=0 items=0 ppid=1 pid=1367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe=2F7362696E2F636772756C6573656E6764202864656C6574656429 subj=system_u:system_r:cgred_t:s0 key=(null)
type=AVC msg=audit(1359978426.667:16668337): avc:  denied  { read } for  pid=1367 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
----
time->Mon Feb  4 06:47:06 2013
type=SYSCALL msg=audit(1359978426.667:16668338): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fff71f2c000 a2=400 a3=0 items=0 ppid=1 pid=1367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe=2F7362696E2F636772756C6573656E6764202864656C6574656429 subj=system_u:system_r:cgred_t:s0 key=(null)
type=AVC msg=audit(1359978426.667:16668338): avc:  denied  { read } for  pid=1367 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
----
time->Mon Feb  4 06:47:06 2013
type=SYSCALL msg=audit(1359978426.667:16668339): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fff71f2c000 a2=400 a3=0 items=0 ppid=1 pid=1367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe=2F7362696E2F636772756C6573656E6764202864656C6574656429 subj=system_u:system_r:cgred_t:s0 key=(null)
type=AVC msg=audit(1359978426.667:16668339): avc:  denied  { read } for  pid=1367 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
----
time->Mon Feb  4 06:47:06 2013
type=SYSCALL msg=audit(1359978426.667:16668340): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fff71f2c000 a2=400 a3=0 items=0 ppid=1 pid=1367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe=2F7362696E2F636772756C6573656E6764202864656C6574656429 subj=system_u:system_r:cgred_t:s0 key=(null)
type=AVC msg=audit(1359978426.667:16668340): avc:  denied  { read } for  pid=1367 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
<--snip-->

Does everything work correctly with a local policy?

Hi Miroslav,

What do you mean by a local policy exactly?

I meant

# grep cgruleseng /var/log/audit/audit.log |audit2allow -R -M mypol
# semodule -i mypol.pp

Yes, after running those commands the denials stopped happening.  Here is the module that was generated:

policy_module(mypol, 1.0)

require {
        type cgred_t;
}

#============= cgred_t ==============
fs_list_inotifyfs(cgred_t)

ok, we need to create a policy bug.

I'm moving this out of 1.1.1 since it will be fixed in base RHEL.  I have cloned the bug there.

Version:
http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.z/2013-03-06.1/

Verify：
1) verifying cgrulesengd denials and 100% cpu utilization on my dev environment
2) upgrade to selinux-policy-mls-3.7.19-195.el6_4.2.noarch.rpm
[root@node ~]# rpm -qa | grep selinux | grep policy
selinux-policy-targeted-3.7.19-195.el6_4.2.noarch
[root@node ~]# grep SELINUXTYPE /etc/selinux/config
# SELINUXTYPE= can take one of these two values:
SELINUXTYPE=targeted

3) smoke tested that everything worked as expected without having to restart cgrulesengd
https://tcms.engineering.redhat.com/run/58770/ 

I will create another bug for tracing the warning message in /var/log/message.

I'm closing this bug since the actual fix shipped with RHEL6.4.  Thanks for the help!