Description of problem: usr/bin/docker info' did not exit successfully Version-Release number of selected component (if applicable): WARNING: Error loading config file:stat /root/.docker/config.json: permission denied' How reproducible: install docker and condor Steps to Reproduce: 1. install all condor and all docker rpms 2. systemctl start docker, systemctl start condor 3. watch in condor log file and find Error loading config file:stat /root/.docker/config.json: permission denied'. Actual results: docker should work Expected results: Additional info:
Is this an SELinux issue? Any AVC's?
Looks like condor script is trying to talk to docker? Talking to the docker daemon is not a good idea, since it would easily lead to a breakout of SELinux protections.
Created attachment 1111845 [details] error caused by condor in audit.log
*** Bug 1295815 has been marked as a duplicate of this bug. ***
Lots of AVC's but none related to docker? setenforce 0 And then see if you get the same issue.
Looks like the HTCondor shared port daemon is the trouble. For now, you can disable it by setting USE_SHARED_PORT = False in your configuration. We'll work with upstream to find a longer-term solution.
I added USE_SHARED_PORT = False to /etc/condor/config.d/00personal_condor.config And now it works. Thanks condor_q -- Schedd: uefi_super_knut : <10.0.0.2:35732?... ID OWNER SUBMITTED RUN_TIME ST PRI SIZE CMD 0 jobs; 0 completed, 0 removed, 0 idle, 0 running, 0 held, 0 suspended
The shared_port daemon talks to the other HTCondor daemons via an abstract unix socket. If the other daemons can't connect to it, then the shared_port can't pass the TCP socket to the appropriate daemon. I think that's the problem here from the audit log snippet: type=AVC msg=audit(1452001275.411:1481): avc: denied { connectto } for pid=5574 comm="condor_shared_p" path=00653435306635336164633836306437623662343634343735303836313162636366393763343663376431323336393838303531373037623466653633353461362F313932355F66376536 scontext=system_u:system_r:condor_master_t:s0 tcontext=system_u:system_r:condor_master_t:s0 tclass=unix_stream_socket permissive=0 Dan, I'm a weakling in terms of SELinux. What's the best way to fix this?
We should add that rule to policy. You can add all of the rules using audit2allow -M mypol # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Would do that but we really want to get these into upstream.
Hi I have still trouble with sending jobs. I get this error UTHENTICATE: handshake failed! 01/05/16 17:27:26 (pid:30687) DC_AUTHENTICATE: authentication of <10.0.0.2:33390> did not result in a valid mapped user name, which is required for this command (1112 QMGMT_WRITE_CMD), so aborting. 01/05/16 17:27:26 (pid:30687) DC_AUTHENTICATE: reason for authentication failure: AUTHENTICATE:1002:Failure performing handshake|AUTHENTICATE:1004:Failed to authenticate using KERBEROS|AUTHENTICATE:1004:Failed to authenticat How can I debug this.
Did you put the machine into permissive mode?
I reinstall condor with default config and I set pc into no permissive mode. condor_submit[23371]: segfault at 0 ip (null) sp 00007ffffd1ade08 error 14 in condor_submit[55ae10152000+37000] [ 6516.443350] condor_submit[26566]: segfault at 0 ip (null) sp 00007ffc55e9b208 error 14 in condor_submit[5637665a5000+37000] [ 6722.348916] condor_submit[29438]: segfault at 0 ip (null) sp 00007ffd26ea3a48 error 14 in condor_submit[55cb49f3d000+37000] [ 6828.814621] condor_submit[32536]: segfault at 0 ip (null) sp 00007ffeb5be2a08 error 14 in condor_submit[562208939000+37000] [ 7106.748125] condor_submit[3064]: segfault at 0 ip (null) sp 00007ffc3e44e588 error 14 in condor_submit[55a3cb571000+37000] [ 8783.352290] condor_submit[6544]: segfault at 0 ip (null) sp 00007fff8472e6f8 error 14 in condor_submit[5573f9638000+37000] [ 8990.987693] condor_submit[12758]: segfault at 0 ip (null) sp 00007fff29618398 error 14 in condor_submit[55b59bccf000+37000] [ 9585.005690] condor_submit[16196]: segfault at 0 ip (null) sp 00007ffcbcfa54b8 error 14 in condor_submit[55ed2069a000+37000] [ 9641.527366] condor_submit[18969]: segfault at 0 ip (null) sp 00007ffd4078bf58 error 14 in condor_submit[55cfa007d000+37000] [ 9813.402527] condor_submit[21899]: segfault at 0 ip (null) sp 00007ffddb197568 error 14 in condor_submit[555f1020f000+37000] [10160.992817] condor_submit[24939]: segfault at 0 ip (null) sp 00007ffe2cba02f8 error 14 in condor_submit[56454d291000+37000] [10229.122971] condor_submit[27946]: segfault at 0 ip (null) sp 00007ffe0ecb01b8 error 14 in condor_submit[55c481774000+37000] [10331.945384] condor_submit[30784]: segfault at 0 ip (null) sp 00007ffef53aff78 error 14 in condor_submit[563b17b0c000+37000]
I was the able to submit jobs. Schedd: uefi_super_knut : <10.0.0.2:9618?... ID OWNER SUBMITTED RUN_TIME ST PRI SIZE CMD 2.1 knutjbj 1/5 17:38 0+00:02:24 R 0 1.2 sh /extra_space/mo 2.2 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.3 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.4 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.5 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.6 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.7 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.8 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.9 knutjbj 1/5 17:38 0+00:02:23 R 0 1.2 sh /extra_space/mo 2.10 knutjbj 1/5 17:38 0+00:02:22 R 0 1.2 sh /extra_space/mo 2.11 knutjbj 1/5 17:38 0+00:02:22 R 0 1.2 sh /extra_space/mo 2.12 knutjbj 1/5 17:38 0+00:00:25 R 0 1.2 sh /extra_space/mo 2.13 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.14 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.15 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.16 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.17 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.18 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.19 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.20 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.21 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.22 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.23 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.24 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.25 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.26 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.27 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.28 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.29 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.30 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.31 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.32 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.33 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.34 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.35 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.36 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.37 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.38 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.39 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.40 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.41 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.42 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.43 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.44 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.45 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.46 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.47 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.48 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.49 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.50 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.51 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.52 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.53 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.54 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.55 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.56 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.57 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.58 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.59 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.60 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.61 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.62 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 2.63 knutjbj 1/5 17:38 0+00:00:00 I 0 1.2 sh /extra_space/mo 4.0 knutjbj 1/5 17:38 0+00:00:00 H 0 1.2 bash -c /usr/local 5.0 knutjbj 1/5 17:38 0+00:02:39 R 0 0.0 cluster4_sentinel.
Yes. The pc is in permissive mode. I was then able to submit jobs. I use bedpostx from fsl as test. I have add this to fsl_sub this is from neurodebian. fsl_sub: if [ "$FSLPARALLEL" = "condor" ] ; then fsl_sub: # if condor shall be used, simply switch to Condor's qsub emulation fsl_sub: qsub_cmd="condor_qsub"
type=AVC msg=audit(1452012862.119:2958): avc: denied { setopt } for pid=3323 comm="condor_schedd" path=00343230626562633339383330656237396237376334653337663438323961336566616235326363383730303565656366356165326539656466323361666461652F333134385F643833615F34 scontext=system_u:system_r:condor_schedd_t:s0 tcontext=system_u:system_r:condor_master_t:s0 tclass=unix_stream_socket permissive=1
sudo grep condor /var/log/audit/audit.log | audit2allow -a #============= condor_collector_t ============== allow condor_collector_t condor_master_t:unix_stream_socket { accept setopt getattr }; #============= condor_master_t ============== allow condor_master_t condor_startd_t:tcp_socket getattr; allow condor_master_t gconf_home_t:dir search; allow condor_master_t ldconfig_exec_t:file { execute getattr }; allow condor_master_t self:capability net_admin; #!!!! This avc is allowed in the current policy allow condor_master_t self:unix_stream_socket connectto; allow condor_master_t sysctl_fs_t:dir search; allow condor_master_t sysctl_fs_t:file { read open getattr }; allow condor_master_t sysctl_kernel_t:file write; allow condor_master_t sysctl_net_t:dir search; allow condor_master_t sysctl_net_t:file { write read open getattr }; #============= condor_negotiator_t ============== allow condor_negotiator_t condor_master_t:unix_stream_socket { accept setopt getattr }; #============= condor_schedd_t ============== allow condor_schedd_t condor_master_t:unix_stream_socket { accept setopt getattr }; allow condor_schedd_t condor_startd_t:process signull; allow condor_schedd_t condor_startd_tmp_t:dir getattr; allow condor_schedd_t fs_t:filesystem getattr; allow condor_schedd_t sendmail_exec_t:file { execute_no_trans execute getattr read open }; #!!!! WARNING: 'unlabeled_t' is a base type. #!!!! The file '/extra_space/moba/cross/dti_tracula/3002/dmri.bedpostX/logs/bpx_preproc.o1' is mislabeled on your system. #!!!! Fix with $ restorecon -R -v /extra_space/fsl_test/cross/dti_tracula/AAAA/dmri.bedpostX/logs/bpx_preproc.o1 allow condor_schedd_t unlabeled_t:file { write open };
This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 23 changed to end-of-life (EOL) status on 2016-12-20. Fedora 23 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.