Bug 1235710
| Summary: | SELinux prevents swift-object-replicator (rsync) to copy data | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Fabien Malfoy <keldrill> | ||||||
| Component: | openstack-selinux | Assignee: | Lon Hohberger <lhh> | ||||||
| Status: | CLOSED DUPLICATE | QA Contact: | nlevinki <nlevinki> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 6.0 (Juno) | CC: | agarciam, lhh, mburns, mgrepl, srevivo | ||||||
| Target Milestone: | --- | Keywords: | ZStream | ||||||
| Target Release: | 8.0 (Liberty) | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2017-01-13 16:35:14 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Can you run this again in permissive mode and attach the AVCs? Just in case there are more AVCs hiding behind this one that enforcing won't catch. Created attachment 1048815 [details]
additional sealert report for the SELinux exception in Permissive mode for swift-object-auditor
Comment on attachment 1048815 [details]
additional sealert report for the SELinux exception in Permissive mode for swift-object-auditor
I am not able to run further tests at the moment but, in the meantime, here is another sealert report regarding SELinux exceptions caught in Permissive mode during the very same experiment.
Please note this is about another component of Swift : swift-object-auditor. However, this is tied to the same issue. Feel free to ask me to create a separate bug report if necessary.
Comment on attachment 1048815 [details]
additional sealert report for the SELinux exception in Permissive mode for swift-object-auditor
It might be important to tell that this sealert report advises to run a restorecon on the device's mountpoint to make its type label "swift_data_t", although all the /srv/node tree was already labeled "swift_data_t" when running the test.
The logs you posted have different AVCs. The only one that I think is causing this issue would be: allow swift_t rsync_exec_t:file execute; *** This bug has been marked as a duplicate of bug 1302312 *** |
Created attachment 1043143 [details] sealert report for the SELinux exception Description of problem: Using OpenStack Swift confined by SELinux (targeted policy), the components swift-account-replicator, responsible for creating the replicas across the nodes, is prevented to execute the rsync command, thus aborting the whole replication operation. Version-Release number of selected component (if applicable): Provided inside the sealert report How reproducible: Install and run OpenStack Swift with the targeted SELinux policy. Make a data replication happen. Steps to Reproduce: 1. Install OpenStack Swift 2. Configure the account ring with one replica 3. Run Swift 4. Store one object 5. Change the account replicas number to 2 and deploy the new ring Actual results: SELinux prevents rsync to be executed Expected results: swift-account-replicator runs rsync to replicate the partitions. Additional info: Might also be the case for the swift-container-replicator and swift-object-replicator