Hide Forgot
+++ This bug was initially created as a clone of Bug #1331559 +++ Description of problem: Cases in pynfs test suite fails because of selinux errors. Version-Release number of selected component (if applicable): nfs-ganesha-2.3.1-4 selinux-policy-3.13.1-60.el7_2.3.noarch selinux-policy-targeted-3.13.1-60.el7_2.3.noarch selinux-policy-devel-3.13.1-60.el7_2.3.noarch How reproducible: Always Steps to Reproduce: 1. Configure nfs-ganesha on a 4 node cluster. 2. Create a dist-rep volume and enable ganesha on it 3. From the client start executing pynfs test suite on the volume Observe that some of the cases fails and some of them are skipped LOOKSOCK st_lookup.testSocket : FAILURE LOOKUP of /testvolume/tree/socket should return NFS4_OK, instead got NFS4ERR_NOENT MKSOCK st_create.testSocket : FAILURE CREATE in empty dir should return NFS4_OK, instead got NFS4ERR_ACCESS ACC1s st_access.testReadSocket : OMIT Dependency LOOKSOCK st_lookup.testSocket had status FAILURE. RM1s st_remove.testSocket : OMIT Dependency MKSOCK st_create.testSocket had status FAILURE. 4. Observe in /var/log/audit/audit.log, below AVC's are seen which are the cause for the failure of cases in pynfs test suite type=AVC msg=audit(1461832513.298:1309): avc: denied { create } for pid=4043 comm="glusterfsd" name="socket" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461832513.199:1325): avc: denied { setattr } for pid=699 comm="glusterfsd" name="socket" dev="dm-44" ino=125829442 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461832513.199:1326): avc: denied { link } for pid=699 comm="glusterfsd" name="socket" dev="dm-44" ino=125829442 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461833178.616:1327): avc: denied { unlink } for pid=3214 comm="glusterfsd" name="18903b90-4434-4eb6-984a-38622c33dda0" dev="dm-38" ino=125838859 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461833054.196:1018): avc: denied { create } for pid=1669 comm="glusterfsd" name="MKSOCK" scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461833054.197:1019): avc: denied { setattr } for pid=1669 comm="glusterfsd" name="MKSOCK" dev="dm-45" ino=25175586 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461833054.197:1020): avc: denied { link } for pid=1669 comm="glusterfsd" name="MKSOCK" dev="dm-45" ino=25175586 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file type=AVC msg=audit(1461833503.077:1021): avc: denied { unlink } for pid=4997 comm="glusterfsd" name="b3b58755-75c0-4839-863d-8cac4d9999d3" dev="dm-42" ino=33554710 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_brick_t:s0 tclass=sock_file Actual results: Cases in pynfs test suite fails because of selinux errors. Expected results: No denial AVC's should be seen and it should not effect any functionality Additional info:
The given local policy works fine; no denial AVC's are seen in audit.log and all the corresponding cases passed without any issues
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html