Hide Forgot
Created attachment 1128338 [details] local .te file that allows dmcache reporting to work Description of problem: I am using SSD's with lvmcache so need to use pcp's pmda to gather and report on cache effectiveness. Out of the box the dmcache report (pcp -h localhost dmcache) just returns 'no values available'. Checking the audit.log shows that selinux is blocking the pcp collector's access to the dmsetup tool - hence the 'no values...' message. Version-Release number of selected component (if applicable): see 'environment' section for list of relevant rpm versions How reproducible: I have 3 systems - all 3 were blocked in the same manner Steps to Reproduce: 1. Configure lvmcache on a rhel7.2 environment 2. install pcp, with the dm pmda (shown above) 3. attempt to use the pcp -h localhost dmcache command Actual results: collector is unable to gather and report any metrics @ Thu Feb 18 16:10:39 2016 (host gprfc085.sbu.lab.eng.bos.redhat.com) ---device--- ---%used--- ---------reads--------- --------writes--------- meta cache hit miss ratio hit miss ratio No values available No values available Expected results: collector should be able to interface with dmsetup to get the cache utilisation information After installing a local policy, this is what you should see @ Thu Feb 18 16:12:17 2016 (host gprfc085.sbu.lab.eng.bos.redhat.com) ---device--- ---%used--- ---------reads--------- --------writes--------- meta cache hit miss ratio hit miss ratio rhgs_vg1-thinpool_tdata 0.7% 9.4% ? ? ?% ? ? ?% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 0.00 0.00 0% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 0.00 0.00 0% rhgs_vg1-thinpool_tdata 0.7% 9.4% 0.00 0.00 0% 1.96 0.00 50.0% Additional info: I have attached the .te that I'm using as the local policy across my systems to allow cache reporting to work.
Please attach the AVCs too. SELinux policy developers would like to see which AVCs appear in enforcing mode and permissive mode.
Created attachment 1128668 [details] audit log containing the denial messages against dmsetup see attached file - dmsetup-audit.log.tar.gz
Here are unique AVCs extracted from the attachment: ---- type=SYSCALL msg=audit(02/18/2016 21:25:07.787:2795226) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x2458a70 a1=0x7fff51406220 a2=0x7fff51406220 a3=0xd items=0 ppid=12756 pid=24944 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:25:07.787:2795226) : avc: denied { getattr } for pid=24944 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file ---- type=SYSCALL msg=audit(02/18/2016 21:38:04.042:2796940) : arch=x86_64 syscall=access success=no exit=-13(Permission denied) a0=0x1d4da70 a1=X_OK a2=0x7ffc75598230 a3=0xd items=0 ppid=32486 pid=32620 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:38:04.042:2796940) : avc: denied { execute } for pid=32620 comm=sh name=dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file ---- type=SYSCALL msg=audit(02/18/2016 21:38:04.042:2796941) : arch=x86_64 syscall=access success=no exit=-13(Permission denied) a0=0x1d4da70 a1=R_OK a2=0x7ffc75598230 a3=0xd items=0 ppid=32486 pid=32620 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:38:04.042:2796941) : avc: denied { read } for pid=32620 comm=sh name=dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file ---- type=SYSCALL msg=audit(02/18/2016 21:46:14.409:2798788) : arch=x86_64 syscall=execve success=no exit=-13(Permission denied) a0=0x1defa70 a1=0x1deed00 a2=0x1dee0c0 a3=0x7ffef046b870 items=0 ppid=4564 pid=4718 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:46:14.409:2798788) : avc: denied { open } for pid=4718 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file ---- type=SYSCALL msg=audit(02/18/2016 21:49:37.630:2799350) : arch=x86_64 syscall=execve success=no exit=-13(Permission denied) a0=0xb20a70 a1=0xb1fd00 a2=0xb1f0c0 a3=0x7ffd2944c3f0 items=0 ppid=6050 pid=6568 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:49:37.630:2799350) : avc: denied { execute_no_trans } for pid=6568 comm=sh path=/usr/sbin/dmsetup dev="dm-0" ino=805377392 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file ---- type=SYSCALL msg=audit(02/18/2016 21:57:19.534:2800521) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x7fff638839a0 a1=O_RDWR a2=0x0 a3=0x7fff63883660 items=0 ppid=9261 pid=14901 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 21:57:19.534:2800521) : avc: denied { read write } for pid=14901 comm=dmsetup name=control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2016 22:01:28.630:2801220) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x7ffcba8ebd40 a1=O_RDWR a2=0x0 a3=0x7ffcba8eba00 items=0 ppid=16523 pid=17866 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 22:01:28.630:2801220) : avc: denied { open } for pid=17866 comm=dmsetup path=/dev/mapper/control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2016 22:07:15.361:2802177) : arch=x86_64 syscall=ioctl success=no exit=-13(Permission denied) a0=0x5 a1=0xc138fd00 a2=0x7f86579b81e0 a3=0x7ffcf4bcf470 items=0 ppid=19270 pid=21155 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 22:07:15.361:2802177) : avc: denied { ioctl } for pid=21155 comm=dmsetup path=/dev/mapper/control dev="devtmpfs" ino=14345 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2016 22:11:01.387:2802731) : arch=x86_64 syscall=ioctl success=no exit=-13(Permission denied) a0=0x5 a1=0xc138fd00 a2=0x7f565c70f1e0 a3=0x7ffc79222510 items=0 ppid=22666 pid=23220 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dmsetup exe=/usr/sbin/dmsetup subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) type=AVC msg=audit(02/18/2016 22:11:01.387:2802731) : avc: denied { sys_admin } for pid=23220 comm=dmsetup capability=sys_admin scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability ----
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html