Bug 1336590
| Summary: | libStorageMgmt: SELinux preventing hpsa plugin from running (avc: denial) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Tony Asleson <tasleson> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.7 | CC: | dwalsh, fge, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, tasleson |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-294.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-21 09:46:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Error message in /var/log/messages which is very deceiving until you realize selinux is involved:
python2: Traceback (most recent call last):
File "/usr/bin/hpsa_lsmplugin", line 25, in <module>
from lsm.plugin.hpsa import SmartArray#012 File "/usr/lib/python2.6/site-packages/lsm/plugin/hpsa/__init__.py", line 1, in <module>
from lsm.plugin.hpsa.hpsa import SmartArray#012 File "/usr/lib/python2.6/site-packages/lsm/plugin/hpsa/hpsa.py", line 23, in <module>
from pyudev import Context, Device, DeviceNotFoundError
File "/usr/lib/python2.6/site-packages/pyudev/__init__.py", line 48, in <module>
from pyudev.device import *
File "/usr/lib/python2.6/site-packages/pyudev/device.py", line 35, in <module>
from pyudev._libudev import libudev
File "/usr/lib/python2.6/site-packages/pyudev/_libudev.py", line 289, in <module>
libudev = load_udev_library()
File "/usr/lib/python2.6/site-packages/pyudev/_libudev.py", line 272, in load_udev_library
raise ImportError('No library named udev')
ImportError: No library named udev
Based on "success=no exit=-13" part of the AVCs, the scenario was executed in enforcing mode. Could you re-run the same scenario in permissive mode, collect SELinux denials and attach them here? (In reply to Milos Malik from comment #3) > Based on "success=no exit=-13" part of the AVCs, the scenario was executed > in enforcing mode. Could you re-run the same scenario in permissive mode, > collect SELinux denials and attach them here? type=AVC msg=audit(1463499284.213:46): avc: denied { read } for pid=2074 comm="lsmd" name="localtime" dev=dm-0 ino=3159 scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file type=AVC msg=audit(1463499284.213:46): avc: denied { open } for pid=2074 comm="lsmd" name="localtime" dev=dm-0 ino=3159 scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file type=SYSCALL msg=audit(1463499284.213:46): arch=c000003e syscall=2 success=yes exit=12 a0=7fc2bac1abaa a1=0 a2=1b6 a3=2 items=0 ppid=1776 pid=2074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="lsmd" exe="/usr/bin/lsmd" subj=system_u:system_r:lsmd_t:s0 key=(null) type=AVC msg=audit(1463499284.213:47): avc: denied { getattr } for pid=2074 comm="lsmd" path="/etc/localtime" dev=dm-0 ino=3159 scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file type=SYSCALL msg=audit(1463499284.213:47): arch=c000003e syscall=5 success=yes exit=0 a0=c a1=7ffc39bf6780 a2=7ffc39bf6780 a3=2 items=0 ppid=1776 pid=2074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="lsmd" exe="/usr/bin/lsmd" subj=system_u:system_r:lsmd_t:s0 key=(null) type=AVC msg=audit(1463499284.785:48): avc: denied { execute } for pid=2078 comm="sh" name="ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=AVC msg=audit(1463499284.785:48): avc: denied { read open } for pid=2078 comm="sh" name="ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=AVC msg=audit(1463499284.785:48): avc: denied { execute_no_trans } for pid=2078 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1463499284.785:48): arch=c000003e syscall=59 success=yes exit=0 a0=1019230 a1=10188b0 a2=10195e0 a3=18 items=0 ppid=2077 pid=2078 auid=4294967295 uid=496 gid=491 euid=496 suid=496 fsuid=496 egid=491 sgid=491 fsgid=491 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null) Fixed in local branch. Waiting for acks. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0627.html |
Description of problem: selinux is preventing plugin hpsa from running: Note: This libStorageMgmt package is in EPEL for EL6, but we don't have the selinux-policy component there, so creating here, please re-assign if not appropriate. Version-Release number of selected component (if applicable): How reproducible: 100% Steps to Reproduce: 1. Install libstoramgmt packages from testing repo: # yum install libstoragemgmt-hpsa-plugin.noarch 2. Try listing all available plugins: $ lsmcli -u sim:// list --type plugins Data: [Errno 104] Connection reset by peer 3. Look at audit.log with avc denials Actual results: $ lsmcli -u sim:// list --type plugins TRANSPORT_COMMUNICATION(400): Error while reading a message from the plug-in from audit.log: type=AVC msg=audit(1463439946.204:65): avc: denied { execute } for pid=2620 comm="sh" name="ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1463439946.204:65): arch=c000003e syscall=59 success=no exit=-13 a0=1fca230 a1=1fc98b0 a2=1fca5e0 a3=18 items=0 ppid=2619 pid=2620 auid=4294967295 uid=496 gid=491 euid=496 suid=496 fsuid=496 egid=491 sgid=491 fsgid=491 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null) type=AVC msg=audit(1463439946.214:66): avc: denied { getattr } for pid=2620 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1463439946.214:66): arch=c000003e syscall=4 success=no exit=-13 a0=1fca230 a1=7fff243faaf0 a2=7fff243faaf0 a3=18 items=0 ppid=2619 pid=2620 auid=4294967295 uid=496 gid=491 euid=496 suid=496 fsuid=496 egid=491 sgid=491 fsgid=491 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null) type=AVC msg=audit(1463439946.214:67): avc: denied { getattr } for pid=2620 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=131332 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1463439946.214:67): arch=c000003e syscall=4 success=no exit=-13 a0=1fca230 a1=7fff243faad0 a2=7fff243faad0 a3=18 items=0 ppid=2619 pid=2620 auid=4294967295 uid=496 gid=491 euid=496 suid=496 fsuid=496 egid=491 sgid=491 fsgid=491 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null) Expected results: # setenforce 0 $ lsmcli -u sim:// list --type plugins Description | Version ---------------------------------- NexentaStor support | 1.3.1 Storage simulator | 1.3.1 LSI MegaRAID Plugin | 1.3.1 NetApp Filer support | 1.3.1 HP SmartArray Plugin | 1.3.1 Linux LIO target support | 1.3.1 Generic SMI-S support | 1.3.1 Compiled plug-in example | 0.2.0 Additional info: Fails on locally built RHEL7 packages too, but will wait until we have testing packages available before writing up BZ. Plugin packages work in fedora 24.