RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1158369 - SELinux policy for bacula doesn't allow writing to tape devices
Summary: SELinux policy for bacula doesn't allow writing to tape devices
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.6
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1197113
TreeView+ depends on / blocked
 
Reported: 2014-10-29 08:51 UTC by Timo Mäkinen
Modified: 2015-07-22 07:09 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-3.7.19-263.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1199585 (view as bug list)
Environment:
Last Closed: 2015-07-22 07:09:24 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1375 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2015-07-20 18:07:47 UTC

Description Timo Mäkinen 2014-10-29 08:51:22 UTC 
Description of problem:
Configuring bacula to write backups to tape device (/dev/nst0) fails in RHEL 6.6 due to new bacula SELinux policy.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-260.el6.noarch
selinux-policy-targeted-3.7.19-260.el6.noarch
bacula-common-5.0.0-12.el6.x86_64
bacula-storage-sqlite-5.0.0-12.el6.x86_64
bacula-storage-common-5.0.0-12.el6.x86_64

How reproducible:
Configure bacula storage daemon to use tape device and try to use it.

Actual results:
SELinux prevents bacula from writing to tape device

Expected results:
Writing to tape from bacula should work

Additional info:
type=AVC msg=audit(1414572589.780:759680): avc:  denied  { read write } for  pid=28411 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1414572589.780:759680): avc:  denied  { open } for  pid=28411 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
Comment 3 Robert Abram 2014-11-06 22:37:03 UTC 
I have incountered this issue as well after upgrading to 6.6.  Creating a policy allowing "read write open" on tape_device_t labeled devices for bacula_t has resolved the issue.
Comment 4 Miroslav Grepl 2014-11-07 09:00:19 UTC 
Robert,
could you please run with

# semanage permissive -a bacula_t

to see if you get more AVC msgs?

Basically it makes only bacula_t as permissive domains.


Thank you.
Comment 5 Timo Mäkinen 2014-11-07 09:51:14 UTC 
I have been running the whole host in permissive mode after the bug to get backups working so i guess i'll get same effect as with making just bacula_t domain permissive?

I can see four types of SELinux denials:

type=AVC msg=audit(1415322011.920:787550): avc:  denied  { open } for  pid=31338 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322019.166:787552): avc:  denied  { read } for  pid=31338 comm="bacula-sd" path="/dev/nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322102.209:787559): avc:  denied  { write } for  pid=31338 comm="bacula-sd" path="/dev/nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322160.209:787567): avc:  denied  { read write } for  pid=2042 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file

So they could be handled with policy like:

allow bacula_t tape_device_t:chr_file { read write open };
Comment 6 Robert Abram 2014-11-07 17:56:50 UTC 
I ran with permissive mode for bacula_t and found many more AVC denials after running a full backup of two servers and running a test restore.  See below.  

I only tested restoring a file, but I suspect that there would be additional AVC denials attempting to restore a directory where the original directory had been deleted.  

type=AVC msg=audit(1415312663.050:1029): avc:  denied  { getattr } for  pid=14147 comm="bacula-fd" path="/var/spool/postfix/public/qmgr" dev=sda3 ino=4325659 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:postfix_public_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.050:1030): avc:  denied  { getattr } for  pid=14147 comm="bacula-fd" path="/var/spool/postfix/public/pickup" dev=sda3 ino=4325657 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:postfix_public_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.355:1031): avc:  denied  { getattr } for  pid=14147 comm="bacula-fd" path="/var/run/autofs.fifo-net" dev=sda3 ino=4325588 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:automount_var_run_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.358:1032): avc:  denied  { getattr } for  pid=14147 comm="bacula-fd" path="/var/run/autofs.fifo-misc" dev=sda3 ino=4325587 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:automount_var_run_t:s0 tclass=fifo_file
type=AVC msg=audit(1415319606.636:1325): avc:  denied  { append } for  pid=14143 comm="bacula-dir" name="Jupiter.bsr" dev=sdc1 ino=97779717 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415319631.183:1326): avc:  denied  { append } for  pid=14143 comm="bacula-dir" name="Pluto.bsr" dev=sdc1 ino=97779720 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.862:3771): avc:  denied  { write } for  pid=20446 comm="bacula-fd" name="software" dev=sdc1 ino=113508353 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1415382639.862:3771): avc:  denied  { add_name } for  pid=20446 comm="bacula-fd" name="test.txt.restore" scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1415382639.862:3771): avc:  denied  { create } for  pid=20446 comm="bacula-fd" name="test.txt.restore" scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.862:3771): avc:  denied  { write } for  pid=20446 comm="bacula-fd" name="test.txt.restore" dev=sdc1 ino=113509492 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.871:3772): avc:  denied  { setattr } for  pid=20446 comm="bacula-fd" name="test.txt.restore" dev=sdc1 ino=113509492 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
Comment 7 Miroslav Grepl 2014-11-10 08:10:31 UTC 
Lukas,
it looks we will need to add additional fixes for bacula.
Comment 8 Timo Mäkinen 2014-12-16 08:40:46 UTC 
Any progress in this?
Comment 10 Miroslav Grepl 2015-03-02 15:01:40 UTC 
commit 5fef7cd165f44d03892ec7cb21550a724f4052fb
Author: Miroslav Grepl <mgrepl>
Date:   Mon Mar 2 16:00:26 2015 +0100

    Add bacula fixes related to unconfined scripts based on ssekidde patch.
Comment 13 Miroslav Grepl 2015-04-01 10:12:36 UTC 
commit ef2bdafea38d7213f2a6d37d4e857dfce712fabf
Author: Simon Sekidde <ssekidde>
Date:   Sat Nov 1 18:09:21 2014 -0400

    Allow bacula access to tape devices BZ# 1158369
Comment 16 errata-xmlrpc 2015-07-22 07:09:24 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1375.html
Note You need to log in before you can comment on or make changes to this bug.