Red Hat Bugzilla – Bug 1216941
[SELinux] RHEL7:SMB: ctdbd does not have write permissions on fuse mount when SELinux is enabled
Last modified: 2015-07-29 00:42:26 EDT
Description of problem: With selinux in enforcing mode, when we start the gluster volume , the samba start hook script fails to execute and dows not create share in smb.conf. If we try to start smb service without using hook script the service smb start succeeds. But if create a volume and start a volume after which it is expected that hook scripts will run and create samba share in smb.conf doesn't work and fails with following errors. If the same test is run in permissive mode, the hook scripts executes successfully and share gets created in smb.conf The error in glusterd logs are as follows: [2015-04-29 06:30:16.070804] E [run.c:190:runner_log] (--> /lib64/libglusterfs.so.0(_gf_log_callingfn+0x186)[0x7f75bdd2c116] (--> /lib64/libglusterfs.so.0(runner_log+0xfc)[0x7f75bdd7919c] (--> /usr/lib64/glusterfs/3.7.0alpha0/xlator/mgmt/glusterd.so(glusterd_hooks_run_hooks+0x47a)[0x7f75b2c2a1ba] (--> /usr/lib64/glusterfs/3.7.0alpha0/xlator/mgmt/glusterd.so(+0xd0772)[0x7f75b2c2a772] (--> /lib64/libpthread.so.0(+0x7df5)[0x7f75bce9bdf5] ))))) 0-management: Failed to execute script: /var/lib/glusterd/hooks/1/start/post/S30samba-start.sh --volname=vol1 --first=yes --version=1 --volume-op=start --gd-workdir=/var/lib/glusterd the AVC denials are as follows: type=AVC msg=audit(1430289182.264:582): avc: denied { getattr } for pid=29427 comm="glusterd" path="/dev/random" dev="devtmpfs" ino=1032 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file type=AVC msg=audit(1430289157.013:580): avc: denied { execute } for pid=29632 comm="glusterd" name="S30samba-start.sh" dev="dm-0" ino=488775 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file type=AVC msg=audit(1430289156.998:579): avc: denied { execute } for pid=29626 comm="glusterd" name="S29CTDBsetup.sh" dev="dm-0" ino=488774 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file type=AVC msg=audit(1430289143.445:573): avc: denied { execute } for pid=29576 comm="glusterd" name="S30samba-stop.sh" dev="dm-0" ino=135416758 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file Version-Release number of selected component (if applicable): samba-4.1.17-5.el7.centos.x86_64 glusterfs-3.7.0alpha0-0.17.gited96153.el7.centos.x86_64 How reproducible: Always Steps to Reproduce: 1.Install RHEL7.1, Install RHS samba rpms, gluster bits 2.create a gluster volume 3.start the volume 4.check if share is created in smb.conf Actual results: hook script fails to execute and samba share is not create din smb.conf Expected results: samba share should get created in smb.conf after a volume start. Additional info: Looks like execution of hook script and editing smb.conf is prevented by selinux.We need to resolve this.
Based on https://bugzilla.redhat.com/show_bug.cgi?id=1224879#c17, looks like the fix is required in gluster side. Could you please check and do the needful to fix the issue? #### Yes, it should be turn on by default by Gluster. setsebool -P use_fusefs_home_dirs 1 ####
Variable has been configured to be set as part of the post-installation procedures. Please verify this works. :)
With the above mentioned build the boolean is not properly set and issues are seen with CTDB failover tests. Opened a new BZ for CTDB failover issue. Once the fix is provided for this BZ , will verify the other BZ too.
The Boolean setsebool -P use_fusefs_home_dirs 1 is set now with the new ctdb build ctdb2.5-2.5.5-3. The fail-over issues were because of other SELinux which are getting fixed as part of the fail-over bz. Marking this BZ as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1495.html