Description of problem: By default, selinux does not allow an administrator of an openshift server to create a heap dump for a customer of their gear. The customer can do it themselves when ssh'ing into their gear and running `jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>`. An administrator should be able to run ` oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS>` to create the heap dump for the customer, but the following selinux denial is encountered: avc: denied { entrypoint } for pid=21533 comm="runcon" path="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.45.x86_64/bin/jmap" dev=dm-0 ino=281147 scontext=unconfined_u:system_r:openshift_t:s0:c0,c1001 tcontext=system_u:object_r:java_exec_t:s0 tclass=file How reproducible: Always Steps to Reproduce: 1. As a user, create a jboss or java gear 2. As root, attempt to create a heap dump with the following command: # oo-su <GEAR_UUID> -c jmap -dump:format=b,file=app-root/data/heap.hprof <PID_OF_JAVA_PROCESS> Actual results: Permission Denied avc denial noted in /var/log/audit/audit.log Expected results: Heap dump created Additional info: Tested with Red Hat Enterprise Linux 6.5 and 6.4 with openshift enterprise 1.2/2.0
We apologize, however, we do not plan to address this report at this time. The majority of our active development is for the v3 version of OpenShift. If you would like for Red Hat to reconsider this decision, please reach out to your support representative. We are very sorry for any inconvenience this may cause.