Bug 985526
| Summary: | ip link show hangs when rtnl_send fails | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Andy Grimm <agrimm> | ||||
| Component: | iproute | Assignee: | Petr Šabata <psabata> | ||||
| Status: | CLOSED ERRATA | QA Contact: | David Spurek <dspurek> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.4 | CC: | avagin, dspurek, ebenes, jgoulding, ksrot, misc, ppisar, vvs | ||||
| Target Milestone: | rc | Keywords: | Patch | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1040367 | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | iproute-2.6.32-24.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: |
Cause:
The ip utility was mishandling netlink communication,
which could cause hangs under certain cirtumstances.
Consequence:
Listing network devices with 'ip link show' hangs in a
SELinux restricted mode.
Fix:
The ip utility now checks for the result of rtnl_send()
before waiting for a reply, avoiding an indefinite hang.
Result:
It is now possible to list network devices in a SELinux
restricted environment.
|
Story Points: | --- | ||||
| Clone Of: | |||||||
| : | 996537 1040454 (view as bug list) | Environment: | |||||
| Last Closed: | 2013-11-21 23:07:03 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Yes, that seems reasonable. This bug also happen on F19, when running selinux with a confined user. So this blocked facter and ansible on my work station.
The exact AVC :
type=AVC msg=audit(1375773208.329:1511): avc: denied { nlmsg_write } for pid=4256 comm="ip" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=netlink_route_socket
Should the bug be cloned for F19 ?
To reproduce ( on F19, but should work equally on RHEL 6 ), add your current user ( or create a new one ) in a confined domain (make sure that you have a root shell opened somewhere or you know how to disable selinux in case you lock yourself out ) : $ sudo semanage login -a -s staff_u -r 's0-s0:c0.c1023' $(id -un) logout ( or login in another tty ) check that you are running a restricted user id: $ id -Z staff_u:staff_r:staff_t:s0-s0:c0.c102c check that you are running in enforcing mode: $ getenforce Enforcing run: $ ip link show em1 and wait I am building a updated package with the proper patch to see if the issue is fixed. And i can say the following patch work Created attachment 783495 [details]
patch from andy to fix the issue
Thanks, Michael! True, this should be cloned for F19 as well. I'll do that. Pushed as iproute-2.6.32-24.el6. I have confirmed that the new build resolves my issue in OpenShift. Thank you, Andy. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1697.html int rtnl_send(struct rtnl_handle *rth, const char *buf, int len)
{
return send(rth->fd, buf, len, 0);
}
"send" returns the number of characters sent.
Are you sure that this patch is correct?
It doesn't work for me.
-bash-4.1# ip link set up dev venet0
RTNETLINK answers: Operation not supported
|
Description of problem: Inside an OpenShift gears, there are various restrictions on a user's access to network interfaces, addresses and ports. One of these restrictions causes "ip link show" to hang. Version-Release number of selected component (if applicable): iproute-2.6.32-23.el6.x86_64 How reproducible: Always (in OpenShift) Steps to Reproduce: 1. Create an OpenShift app 2. rhc ssh <appname> 3. run "ip link show lo" Actual results: The command hangs until you kill it. Expected results: It should not hang Additional info: I did an strace and found this happening: bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 getsockname(3, {sa_family=AF_NETLINK, pid=32592, groups=00000000}, [12]) = 0 gettimeofday({1374074067, 433784}, NULL) = 0 sendto(3, " \0\0\0\20\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 32, 0, NULL, 0) = -1 EACCES (Permission denied) recvmsg(3, ^C <unfinished ...> so I did a debug build inside my openshift gear, and tracked it down to this bit of code in iplink.c at line 160: rtnl_send(&rth, (char *)&req.n, req.n.nlmsg_len); rtnl_listen(&rth, accept_msg, NULL); If I change this to: if (rtnl_send(&rth, (char *)&req.n, req.n.nlmsg_len) == 0) rtnl_listen(&rth, accept_msg, NULL); then the issue is resolved.