Bug 1051140 - Selinux does not allow root to create heap dump of user's jboss/java gear by default
Summary: Selinux does not allow root to create heap dump of user's jboss/java gear by ...
Alias: None
Product: OKD
Classification: Red Hat
Component: Containers
Version: 2.x
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Abhishek Gupta
QA Contact: libra bugs
Depends On:
Blocks: 1051141
TreeView+ depends on / blocked
Reported: 2014-01-09 18:35 UTC by Timothy Williams
Modified: 2017-05-31 18:22 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1051141 (view as bug list)
Last Closed: 2017-05-31 18:22:11 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Timothy Williams 2014-01-09 18:35:30 UTC
Description of problem:
By default, selinux does not allow an administrator of an openshift server to create a heap dump for a customer of their gear. The customer can do it themselves when ssh'ing into their gear and running `jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>`.

An administrator should be able to run ` oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>` to create the heap dump for the customer, but the following selinux denial is encountered: 

avc:  denied  { entrypoint } for  pid=21533 comm="runcon" path="/usr/lib/jvm/java-1.7.0-openjdk-" dev=dm-0 ino=281147 scontext=unconfined_u:system_r:openshift_t:s0:c0,c1001 tcontext=system_u:object_r:java_exec_t:s0 tclass=file

How reproducible:

Steps to Reproduce:
1. As a user, create a jboss or java gear
2. As root, attempt to create a heap dump with the following command:
	# oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>

Actual results:
Permission Denied
avc denial noted in /var/log/audit/audit.log

Expected results:
Heap dump created

Additional info:
Tested with Red Hat Enterprise Linux 6.5 and 6.4 with openshift enterprise 1.2/2.0

Comment 1 Eric Paris 2017-05-31 18:22:11 UTC
We apologize, however, we do not plan to address this report at this time. The majority of our active development is for the v3 version of OpenShift. If you would like for Red Hat to reconsider this decision, please reach out to your support representative. We are very sorry for any inconvenience this may cause.

Note You need to log in before you can comment on or make changes to this bug.