Bug 986023
| Summary: | SELinux prevents glusterfs mount at boot | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Michael Cronenworth <mike> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 19 | CC: | dominick.grift, dwalsh, mgrepl | ||||
| Target Milestone: | --- | Keywords: | Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.12.1-71.fc19 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-08-22 00:51:48 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Still broken in selinux-policy-3.12.1-65.fc19.noarch.
Enforcing:
[ 8.769934] type=1400 audit(1374649672.856:4): avc: denied { module_request } for pid=1228 comm="glusterfs" kmod="char-major-10-229" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
[ 8.775263] type=1400 audit(1374649672.862:5): avc: denied { module_request } for pid=1227 comm="glusterfs" kmod="char-major-10-229" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
#============= glusterd_t ============== #!!!! This avc is allowed in the current policy allow glusterd_t kernel_t:system module_request; selinux-policy-3.12.1-66.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-66.fc19 Package selinux-policy-3.12.1-66.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-66.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-13543/selinux-policy-3.12.1-66.fc19 then log in and leave karma (feedback). Does not fix this issue. New AVC messages.
[ 8.846060] fuse init (API version 7.21)
[ 8.848492] type=1400 audit(1374717534.942:4): avc: denied { mounton } for pid=1236 comm="glusterfs" path="/media/michael" dev="md0" ino=922299 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[ 8.850622] type=1400 audit(1374717534.944:5): avc: denied { mounton } for pid=1232 comm="glusterfs" path="/media/media" dev="md0" ino=918192 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[ 8.853022] type=1400 audit(1374717534.947:6): avc: denied { mounton } for pid=1245 comm="fusermount-glus" path="/media/media" dev="md0" ino=918192 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[ 8.853024] type=1400 audit(1374717534.947:7): avc: denied { mounton } for pid=1244 comm="fusermount-glus" path="/media/michael" dev="md0" ino=922299 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[ 8.854095] SELinux: initialized (dev fusectl, type fusectl), uses genfs_contexts
[ 8.854794] type=1400 audit(1374717534.948:8): avc: denied { net_admin } for pid=1237 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
[ 8.854809] type=1400 audit(1374717534.948:9): avc: denied { net_admin } for pid=1237 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
[ 8.854826] type=1400 audit(1374717534.948:10): avc: denied { net_admin } for pid=1237 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
[ 8.856638] type=1400 audit(1374717534.950:11): avc: denied { net_admin } for pid=1234 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
[ 8.856647] type=1400 audit(1374717534.950:12): avc: denied { net_admin } for pid=1234 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
[ 8.856654] type=1400 audit(1374717534.950:13): avc: denied { net_admin } for pid=1234 comm="glusterfs" capability=12 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:glusterd_t:s0 tclass=capability
selinux-policy-3.12.1-66.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. Fixes have been added. selinux-policy-3.12.1-69.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-69.fc19 Package selinux-policy-3.12.1-69.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-69.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-14089/selinux-policy-3.12.1-69.fc19 then log in and leave karma (feedback). Still broken.
[ 8.764460] fuse init (API version 7.21)
[ 8.766871] SELinux: initialized (dev fuse, type fuse), uses genfs_contexts
[ 8.766900] type=1400 audit(1375486137.855:4): avc: denied { mount } for pid=1234 comm="glusterfs" name="/" dev="fuse" ino=1 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=filesystem
[ 8.768445] SELinux: initialized (dev fuse, type fuse), uses genfs_contexts
[ 8.768459] type=1400 audit(1375486137.857:5): avc: denied { mount } for pid=1238 comm="glusterfs" name="/" dev="fuse" ino=1 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=filesystem
[ 8.773182] SELinux: initialized (dev fusectl, type fusectl), uses genfs_contexts
selinux-policy-3.12.1-69.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. Not fixed. See comment 11. These are different. I added fixes.
Author: Miroslav Grepl <mgrepl>
Date: Mon Aug 5 07:26:57 2013 +0200
Allow glusterd to mount filesystems
I can confirm that this is finally fixed with selinux-policy-3.12.1-70.fc19. Thanks. selinux-policy-3.12.1-71.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-71.fc19 Package selinux-policy-3.12.1-71.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-71.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-15088/selinux-policy-3.12.1-71.fc19 then log in and leave karma (feedback). selinux-policy-3.12.1-71.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 775472 [details] AVC messages Description of problem: I have two glusterfs mounts in my fstab. Under Fedora 18 they mounted fine at boot. After upgrading to Fedora 19 they are no longer mounted at boot. Mounting them manually works just fine. I have attached the AVC output from Enforcing. (glusterfs-enforcing.txt) Setting SELinux to permissive allows the mount points to be mounted at boot. There are additional AVC messages found after boot. (glusterfs-permissive.txt) Version-Release number of selected component (if applicable): selinux-policy-3.12.1-63.fc19.noarch glusterfs-3.4.0-0.9.beta4.fc19.x86_64 How reproducible: Always Steps to Reproduce: 1. Add a glusterfs mount point to fstab. 2. Reboot. 3. ls /mnt/point (empty) Actual results: ls /mnt/point returns nothing. Expected results: ls /mnt/point returns files. Additional info: /etc/fstab: 10.0.0.1:/michael /media/michael glusterfs defaults,_netdev 0 0 10.0.0.1:/media /media/media glusterfs defaults,_netdev 0 0