Bug 956260
| Summary: | MLS: Cannot boot machine with SELinux in enforcing with LVM | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Miroslav Vadkerti <mvadkert> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Miroslav Vadkerti <mvadkert> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.0 | CC: | arubin, dwalsh, jjaburek, mgrepl, mmalik |
| Target Milestone: | beta | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 09:41:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 717785, 893599 | ||
Did you do something to show this?
Apr 24 15:34:15 cc-ns1 kernel: [ 5.814773] type=1400 audit(1366810441.813:60): avc: granted { setfscreate } for pid=284 comm="lvm2-activation" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tclass=process
This is an auditallow line.
d709564ec1ea19bfef770a57d05625946c5256e0 fixes lvm creating its own unit file in git.
No, I didn't do anything special to show this. I didn't add any auditallow rules. (In reply to comment #2) > Did you do something to show this? > > Apr 24 15:34:15 cc-ns1 kernel: [ 5.814773] type=1400 > audit(1366810441.813:60): avc: granted { setfscreate } for pid=284 > comm="lvm2-activation" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 > tcontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tclass=process > > This is an auditallow line. > > d709564ec1ea19bfef770a57d05625946c5256e0 fixes lvm creating its own unit > file in git. Maybe this is something in the audit system causing this, or MLS LSPP installs a special policy that watches for SELinux interactions? AFAIK MLS LSPP installs a special policy. Added additional fixes.
commit 602dd4a8cd08ea856cd96ca6727770a1242d1655
Author: Miroslav Grepl <mgrepl>
Date: Mon Jun 24 20:29:00 2013 +0200
Allow lvm_t to create default targets for filesystem handling
VERIFIED as fixed in selinux-policy-3.12.1-59.el7. This bug will be implicitly tested by our CC testing efforts. Putting qe_test_coverage+. This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |
Description of problem: I cannot boot my test RHEL7 machine in MLS with SELinux in enforcing mode. In /var/log/messages I see these denials: [root/sysadm_r/s0@cc-ns1 ~]# grep lvm2-activation /var/log/messages | grep 15:34 Apr 24 15:34:15 cc-ns1 kernel: [ 5.814535] type=1400 audit(1366810441.813:59): avc: granted { setfscreate } for pid=284 comm="lvm2-activation" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tclass=process Apr 24 15:34:15 cc-ns1 kernel: [ 5.814571] type=1300 audit(1366810441.813:59): arch=c000003e syscall=1 success=yes exit=32 a0=5 a1=1ecc9f0 a2=20 a3=30733a745f6b63 items=0 ppid=1 pid=284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lvm2-activation" exe="/usr/lib/systemd/system-generators/lvm2-activation-generator" subj=system_u:system_r:lvm_t:s0-s15:c0.c1023 key=(null) Apr 24 15:34:15 cc-ns1 kernel: [ 5.814773] type=1400 audit(1366810441.813:60): avc: granted { setfscreate } for pid=284 comm="lvm2-activation" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tclass=process Apr 24 15:34:15 cc-ns1 kernel: [ 5.814815] type=1300 audit(1366810441.813:60): arch=c000003e syscall=1 success=yes exit=0 a0=5 a1=0 a2=0 a3=746165726373662f items=0 ppid=1 pid=284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lvm2-activation" exe="/usr/lib/systemd/system-generators/lvm2-activation-generator" subj=system_u:system_r:lvm_t:s0-s15:c0.c1023 key=(null) Apr 24 15:34:15 cc-ns1 kernel: [ 5.815295] type=1400 audit(1366810441.814:61): avc: denied { write } for pid=284 comm="lvm2-activation" name="generator" dev="tmpfs" ino=9736 scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir Apr 24 15:34:15 cc-ns1 kernel: [ 5.815321] type=1400 audit(1366810441.814:61): avc: denied { add_name } for pid=284 comm="lvm2-activation" name="lvm2-activation-early.service" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir Apr 24 15:34:15 cc-ns1 kernel: [ 5.815373] type=1400 audit(1366810441.814:61): avc: denied { create } for pid=284 comm="lvm2-activation" name="lvm2-activation-early.service" scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=file Apr 24 15:34:15 cc-ns1 kernel: [ 5.815404] type=1400 audit(1366810441.814:61): avc: denied { write open } for pid=284 comm="lvm2-activation" path="/run/systemd/generator/lvm2-activation-early.service" dev="tmpfs" ino=9791 scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=file Apr 24 15:34:15 cc-ns1 kernel: [ 5.815432] type=1300 audit(1366810441.814:61): arch=c000003e syscall=2 success=yes exit=4 a0=6040e0 a1=802c1 a2=1b6 a3=3 items=0 ppid=1 pid=284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lvm2-activation" exe="/usr/lib/systemd/system-generators/lvm2-activation-generator" subj=system_u:system_r:lvm_t:s0-s15:c0.c1023 key=(null) Apr 24 15:34:15 cc-ns1 kernel: [ 5.815459] type=1400 audit(1366810441.814:62): avc: denied { getattr } for pid=284 comm="lvm2-activation" path="/run/systemd/generator/lvm2-activation-early.service" dev="tmpfs" ino=9791 scontext=system_u:system_r:lvm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=file Version-Release number of selected component (if applicable): selinux-policy-3.12.1-32.el7.noarch How reproducible: 100% Steps to Reproduce: 1. Install RHEL7 in MLS mode with LVM partitions 2. Try to boot with SELinux in enforcing mode Actual results: Cannot boot + AVC denials Expected results: Can boot and no AVC denials Additional info: