Hide Forgot
Description of problem: type=1400 audit(1452883155.324:7): avc: denied { write } for pid=2704 comm="rhsmcertd-worke" name=".dbenv.lock" dev="dm-0" ino=8979114 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file This happens intermittently on RHEL Atomic Host during the Cockpit integration tests. This seems to happen shortly after mounting a container: Jan 15 18:39:14 localhost.localdomain.localdomain docker[1910]: time="2016-01-15T18:39:14.951350343Z" level=info msg="POST /v1.20/containers/create" Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Unmounting Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Unmounting Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain docker[1910]: time="2016-01-15T18:39:15.301390405Z" level=info msg="POST /v1.20/containers/a79b8a26fa7f4533af6ac7b6456d032dcf02474b6003e1a2d052f716b8e43389/start" Jan 15 18:39:15 localhost.localdomain.localdomain kernel: type=1400 audit(1452883155.324:7): avc: denied { write } for pid=2704 comm="rhsmcertd-worke" name=".dbenv.lock" dev="dm-0" ino=8979114 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file Jan 15 18:39:15 localhost.localdomain.localdomain systemd[1]: Device dev-disk-by\x2duuid-4d2bce40\x2d1a3e\x2d4192\x2d8ae5\x2d8d297b2cbbae.device appeared twice with different sysfs paths /sys/devices/virtual/block/dm-4 and /sys/devices/virtual/block/dm-5 Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Mounting V4 Filesystem Jan 15 18:39:15 localhost.localdomain.localdomain kernel: XFS (dm-5): Ending clean mount Jan 15 18:39:15 localhost.localdomain.localdomain kernel: SELinux: initialized (dev dm-5, type xfs), uses xattr Versions: selinux-policy-targeted-3.13.1-60.el7.noarch subscription-manager-1.15.9-15.el7.x86_64 # atomic host status TIMESTAMP (UTC) VERSION ID OSNAME REFSPEC * 2015-12-03 19:40:36 7.2.1 aaf67b91fa rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard 2015-11-10 16:11:46 7.2 ec85fba1bf rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
This bug was discovered by the Cockpit integration tests. https://fedorapeople.org/groups/cockpit/logs/pull-3456-3041953a-rhel-atomic/ Cockpit will be ignoring this message in the integration tests from here on out: https://github.com/cockpit-project/cockpit/pull/3492
It looks /var/lib/rpm is mislabeled on Atomic Hosts. What does $ ls -dZ /var/lib/rpm ?
# ls -dZ /var/lib/rpm lrwxrwxrwx. root root system_u:object_r:rpm_var_lib_t:s0 /var/lib/rpm -> ../../usr/share/rpm # ls -dZ /usr/share/rpm drwxr-xr-x. root root system_u:object_r:usr_t:s0 /usr/share/rpm
Hopefully this is fixed.
The file contexts are still identical to those above: -bash-4.2# ls -dZ /var/lib/rpm lrwxrwxrwx. root root system_u:object_r:rpm_var_lib_t:s0 /var/lib/rpm -> ../../usr/share/rpm -bash-4.2# ls -dZ /usr/share/rpm drwxr-xr-x. root root system_u:object_r:usr_t:s0 /usr/share/rpm -bash-4.2# atomic host status State: idle Deployments: ● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.2.6 (2016-07-29 19:54:25) Commit: b672bf8a457cb28e003dee20c53749636ef5fce3e4743afe4aaad269d3aaa62a OSName: rhel-atomic-host Removing the workaround in Cockpit so we can get proof either way: https://github.com/cockpit-project/cockpit/pull/4918