Bug 1158369
| Summary: | SELinux policy for bacula doesn't allow writing to tape devices | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Timo Mäkinen <tmakinen> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 6.6 | CC: | dwalsh, mgrepl, mmalik, plautrba, pvrabec, rob_abram, ssekidde, tmakinen, todoleza | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.7.19-263.el6 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1199585 (view as bug list) | Environment: | ||
| Last Closed: | 2015-07-22 07:09:24 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1197113 | |||
I have incountered this issue as well after upgrading to 6.6. Creating a policy allowing "read write open" on tape_device_t labeled devices for bacula_t has resolved the issue. Robert, could you please run with # semanage permissive -a bacula_t to see if you get more AVC msgs? Basically it makes only bacula_t as permissive domains. Thank you. I have been running the whole host in permissive mode after the bug to get backups working so i guess i'll get same effect as with making just bacula_t domain permissive?
I can see four types of SELinux denials:
type=AVC msg=audit(1415322011.920:787550): avc: denied { open } for pid=31338 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322019.166:787552): avc: denied { read } for pid=31338 comm="bacula-sd" path="/dev/nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322102.209:787559): avc: denied { write } for pid=31338 comm="bacula-sd" path="/dev/nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
type=AVC msg=audit(1415322160.209:787567): avc: denied { read write } for pid=2042 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file
So they could be handled with policy like:
allow bacula_t tape_device_t:chr_file { read write open };
I ran with permissive mode for bacula_t and found many more AVC denials after running a full backup of two servers and running a test restore. See below.
I only tested restoring a file, but I suspect that there would be additional AVC denials attempting to restore a directory where the original directory had been deleted.
type=AVC msg=audit(1415312663.050:1029): avc: denied { getattr } for pid=14147 comm="bacula-fd" path="/var/spool/postfix/public/qmgr" dev=sda3 ino=4325659 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:postfix_public_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.050:1030): avc: denied { getattr } for pid=14147 comm="bacula-fd" path="/var/spool/postfix/public/pickup" dev=sda3 ino=4325657 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:postfix_public_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.355:1031): avc: denied { getattr } for pid=14147 comm="bacula-fd" path="/var/run/autofs.fifo-net" dev=sda3 ino=4325588 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:automount_var_run_t:s0 tclass=fifo_file
type=AVC msg=audit(1415312663.358:1032): avc: denied { getattr } for pid=14147 comm="bacula-fd" path="/var/run/autofs.fifo-misc" dev=sda3 ino=4325587 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:automount_var_run_t:s0 tclass=fifo_file
type=AVC msg=audit(1415319606.636:1325): avc: denied { append } for pid=14143 comm="bacula-dir" name="Jupiter.bsr" dev=sdc1 ino=97779717 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415319631.183:1326): avc: denied { append } for pid=14143 comm="bacula-dir" name="Pluto.bsr" dev=sdc1 ino=97779720 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.862:3771): avc: denied { write } for pid=20446 comm="bacula-fd" name="software" dev=sdc1 ino=113508353 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1415382639.862:3771): avc: denied { add_name } for pid=20446 comm="bacula-fd" name="test.txt.restore" scontext=unconfined_u:system_r:bacula_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1415382639.862:3771): avc: denied { create } for pid=20446 comm="bacula-fd" name="test.txt.restore" scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.862:3771): avc: denied { write } for pid=20446 comm="bacula-fd" name="test.txt.restore" dev=sdc1 ino=113509492 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1415382639.871:3772): avc: denied { setattr } for pid=20446 comm="bacula-fd" name="test.txt.restore" dev=sdc1 ino=113509492 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
Lukas, it looks we will need to add additional fixes for bacula. Any progress in this? commit 5fef7cd165f44d03892ec7cb21550a724f4052fb
Author: Miroslav Grepl <mgrepl>
Date: Mon Mar 2 16:00:26 2015 +0100
Add bacula fixes related to unconfined scripts based on ssekidde patch.
commit ef2bdafea38d7213f2a6d37d4e857dfce712fabf
Author: Simon Sekidde <ssekidde>
Date: Sat Nov 1 18:09:21 2014 -0400
Allow bacula access to tape devices BZ# 1158369
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1375.html |
Description of problem: Configuring bacula to write backups to tape device (/dev/nst0) fails in RHEL 6.6 due to new bacula SELinux policy. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-260.el6.noarch selinux-policy-targeted-3.7.19-260.el6.noarch bacula-common-5.0.0-12.el6.x86_64 bacula-storage-sqlite-5.0.0-12.el6.x86_64 bacula-storage-common-5.0.0-12.el6.x86_64 How reproducible: Configure bacula storage daemon to use tape device and try to use it. Actual results: SELinux prevents bacula from writing to tape device Expected results: Writing to tape from bacula should work Additional info: type=AVC msg=audit(1414572589.780:759680): avc: denied { read write } for pid=28411 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file type=AVC msg=audit(1414572589.780:759680): avc: denied { open } for pid=28411 comm="bacula-sd" name="nst0" dev=devtmpfs ino=12339 scontext=system_u:system_r:bacula_t:s0 tcontext=system_u:object_r:tape_device_t:s0 tclass=chr_file