RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1244274 - [SELinux] nfs-ganesha: AVC denied for nfs-ganesha.service , ganesha cluster setup fails in Rhel6.7
Summary: [SELinux] nfs-ganesha: AVC denied for nfs-ganesha.service , ganesha cluster s...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.7
Hardware: x86_64
OS: Linux
urgent
high
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On: 1242476
Blocks: 1202842 1212796 1248525
TreeView+ depends on / blocked
 
Reported: 2015-07-17 16:20 UTC by Prasanth
Modified: 2016-05-10 19:59 UTC (History)
15 users (show)

Fixed In Version: selinux-policy-3.7.19-279.el6
Doc Type: Bug Fix
Doc Text:
Clone Of: 1242487
: 1248525 (view as bug list)
Environment:
Last Closed: 2016-05-10 19:59:48 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:0763 0 normal SHIPPED_LIVE selinux-policy bug fix update 2016-05-10 22:33:46 UTC

Description Prasanth 2015-07-17 16:20:06 UTC
+++ This bug was initially created as a clone of Bug #1242487 +++

Description of problem:
Selinux: AVC denied for nfs-ganesha.service , ganesha cluster setup fails in Rhel7

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-31.el7.noarch
glusterfs-3.7.1-9.el7rhgs.x86_64
nfs-ganesha-2.2.0-5.el7rhgs.x86_64

How reproducible: Always


Steps to Reproduce:
1. gluster nfs-ganesha enable command fails.
[root@nfs1 ~]# gluster nfs-ganesha enable
Enabling NFS-Ganesha requires Gluster-NFS to be disabled across the trusted pool. Do you still want to continue?
 (y/n) y
This will take a few minutes to complete. Please wait ..
nfs-ganesha: failed: NFS-Ganesha failed to start.Please see log file for details

following avc denied message found in audit.log:

type=USER_AVC msg=audit(1436750416.293:3599): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/nfs-ganesha.service" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:nfsd_unit_file_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'


Actual results: Ganesha Cluster setup fails due to denied avc errors


Expected results: No avc denied errors


Additional info:

--- Additional comment from Red Hat Bugzilla Rules Engine on 2015-07-13 08:19:19 EDT ---

This bug is automatically being proposed for Red Hat Gluster Storage 3.1.0 by setting the release flag 'rhgs‑3.1.0' to '?'. 

If this bug should be proposed for a different release, please manually change the proposed release flag.

--- Additional comment from Milos Malik on 2015-07-13 08:50:13 EDT ---

# cat bz1242487.te 
policy_module(bz1242487,1.0)

require {
  type glusterd_t;
  type nfsd_unit_file_t;
  class service { start stop status enable disable load reload };
}

allow glusterd_t nfsd_unit_file_t : service { start stop status enable disable load reload };

# make -f /usr/share/selinux/devel/Makefile 
Compiling targeted bz1242487 module
/usr/bin/checkmodule:  loading policy configuration from tmp/bz1242487.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/bz1242487.mod
Creating targeted bz1242487.pp policy package
rm tmp/bz1242487.mod tmp/bz1242487.mod.fc
# semodule -i bz1242487.pp 
#

Does it work now?

--- Additional comment from Apeksha on 2015-07-13 11:01:02 EDT ---

Yes, with the local fix i am able to set up the ganesha cluster and not seeing avc denied for nfs-ganesha service.

But i am seeing 3 more new AVC denied errors:

1.  type=AVC msg=audit(1436760013.962:3807): avc:  denied  { read } for  pid=13677 comm="find" name="sepolgen" dev="dm-0" ino=135293101 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=dir

2.  type=AVC msg=audit(1436760018.523:3817): avc:  denied  { connectto } for  pid=13746 comm="crm_mon" path=006369625F726F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=unix_stream_socket

3.  type=AVC msg=audit(1436760019.680:3818): avc:  denied  { connectto } for  pid=13750 comm="cibadmin" path=006369625F72770000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=unix_stream_socket

--- Additional comment from Milos Malik on 2015-07-13 11:11:43 EDT ---

# cat bz1242487.te 
policy_module(bz1242487,1.0)

require {
  type glusterd_t;
  type cluster_t;
  type nfsd_unit_file_t;
  class service { start stop status enable disable load reload };
  class unix_stream_socket { connectto };
}

allow glusterd_t nfsd_unit_file_t : service { start stop status enable disable load reload };
allow glusterd_t cluster_t : unix_stream_socket { connectto };

# make -f /usr/share/selinux/devel/Makefile 
Compiling targeted bz1242487 module
/usr/bin/checkmodule:  loading policy configuration from tmp/bz1242487.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/bz1242487.mod
Creating targeted bz1242487.pp policy package
rm tmp/bz1242487.mod tmp/bz1242487.mod.fc
# semodule -i bz1242487.pp 
#

--- Additional comment from Milos Malik on 2015-07-13 11:19:28 EDT ---

Is Ganesha able to start various cluster services ? Does Ganesha use init scripts or systemd unit files when starting them ?

--- Additional comment from Meghana on 2015-07-13 11:55:34 EDT ---

Hi Milos,

We execute "service nfs-ganesha start" to start the NFS-Ganesha service. And after that, as part of the set up, we run various pcs commands to set up the cluster. crm_mon errors are related to corosync/pacemaker as far as I can see.
The set up would have failed because NFS-GAnesha didn't start in the first place.

--- Additional comment from Apeksha on 2015-07-13 11:58:39 EDT ---

I was able to setup the cluster with the work around in comment 2.
But yes i am seeing 3 more avc denied errors as mentioned in comment 3.

--- Additional comment from Prasanth on 2015-07-14 01:32:58 EDT ---

(In reply to Apeksha from comment #7)
> I was able to setup the cluster with the work around in comment 2.
> But yes i am seeing 3 more avc denied errors as mentioned in comment 3.

Apeksha, Milos has provided an updated local policy module in Comment 4 which should resolve the 3 other AVC's you had seen. So please apply that and let us know the test results.

--- Additional comment from Apeksha on 2015-07-14 02:04:49 EDT ---

With the work around mentioned in comment 4, i am able to set up the ganesha clutser, but seeing 2 avc errors:

1. type=AVC msg=audit(1436813573.923:5217): avc:  denied  { read } for  pid=16855 comm="find" name="sepolgen" dev="dm-0" ino=135293101 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=dir

2. type=USER_AVC msg=audit(1436813579.129:5220): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=-1 uid=0 gid=0 path="system" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

--- Additional comment from Red Hat Bugzilla Rules Engine on 2015-07-14 07:20:20 EDT ---

Since this bug has been approved for the Red Hat Gluster Storage 3.1.0 release, through release flag 'rhgs-3.1.0+', the Target Release is being automatically set to 'RHGS 3.1.0'

--- Additional comment from Apeksha on 2015-07-17 05:23:45 EDT ---

seeing this avc denied error on a fresh rhel7.1 setup with latest selinux rpm - selinux-policy-3.13.1-32.el7.noarch

type=USER_AVC msg=audit(1437124950.248:2418): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/nfs-ganesha.service" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:nfsd_unit_file_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Is this avc message fixed in this rpm - selinux-policy-3.13.1-32.el7.noarch ?

Or we have to still use the workaround mentioned in comment2/comment4?

--- Additional comment from Milos Malik on 2015-07-17 05:33:14 EDT ---

# rpm -qa selinux-policy\*
selinux-policy-minimum-3.13.1-33.el7.noarch
selinux-policy-sandbox-3.13.1-33.el7.noarch
selinux-policy-doc-3.13.1-33.el7.noarch
selinux-policy-3.13.1-33.el7.noarch
selinux-policy-targeted-3.13.1-33.el7.noarch
selinux-policy-devel-3.13.1-33.el7.noarch
selinux-policy-mls-3.13.1-33.el7.noarch
# sesearch -s glusterd_t -t nfsd_unit_file_t -c service -A -C

# sesearch -s glusterd_t -t nfsd_unit_file_t -c service -D -C

# 

Unfortunately, the workaround is still needed.

--- Additional comment from Prasanth on 2015-07-17 07:31:18 EDT ---

(In reply to Apeksha from comment #11)
> seeing this avc denied error on a fresh rhel7.1 setup with latest selinux
> rpm - selinux-policy-3.13.1-32.el7.noarch
> 
> type=USER_AVC msg=audit(1437124950.248:2418): pid=1 uid=0 auid=4294967295
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start }
> for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/nfs-ganesha.service"
> scontext=system_u:system_r:glusterd_t:s0
> tcontext=system_u:object_r:nfsd_unit_file_t:s0 tclass=service 
> exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> 
> Is this avc message fixed in this rpm - selinux-policy-3.13.1-32.el7.noarch ?
> 
> Or we have to still use the workaround mentioned in comment2/comment4?

The latest available policy is selinux-policy-3.13.1-33.el7. Are you see this issue in that as well? Please check and confirm.

--- Additional comment from Prasanth on 2015-07-17 07:56:38 EDT ---

Apeksha, what I understood from Milos is that the workaround from comment#4 will be needed until mgrepl creates a new build -34.el7 which will have all the fixes.

--- Additional comment from Saurabh on 2015-07-17 09:31:08 EDT ---

(In reply to Prasanth from comment #13)
> (In reply to Apeksha from comment #11)
> > seeing this avc denied error on a fresh rhel7.1 setup with latest selinux
> > rpm - selinux-policy-3.13.1-32.el7.noarch
> > 
> > type=USER_AVC msg=audit(1437124950.248:2418): pid=1 uid=0 auid=4294967295
> > ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start }
> > for auid=-1 uid=0 gid=0 path="/usr/lib/systemd/system/nfs-ganesha.service"
> > scontext=system_u:system_r:glusterd_t:s0
> > tcontext=system_u:object_r:nfsd_unit_file_t:s0 tclass=service 
> > exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> > 
> > Is this avc message fixed in this rpm - selinux-policy-3.13.1-32.el7.noarch ?
> > 
> > Or we have to still use the workaround mentioned in comment2/comment4?
> 
> The latest available policy is selinux-policy-3.13.1-33.el7. Are you see
> this issue in that as well? Please check and confirm.

Yes, she has seen the issue with the latest rpms also, she had to put the workaround as mentioned above in this BZ. 

So it will be preferrable that we have the workaround in rpms.
Milos, can you confirm that we will have rpms having the fix for the issue so that we can avoid using the workaround?

--- Additional comment from Milos Malik on 2015-07-17 11:49:11 EDT ---

My plan is to persuade mgrepl to put as many fixes as possible into selinux-policy builds so that you don't need to use workarounds.

Comment 6 errata-xmlrpc 2016-05-10 19:59:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0763.html


Note You need to log in before you can comment on or make changes to this bug.