Red Hat Bugzilla – Bug 1347391
[RH Ceph 2.0 / 10.2.2-2] selinux avc: denied { chown } for pid=12251 comm="radosgw"
Last modified: 2016-08-23 15:42:04 EDT
Description of problem: Following denial found during smoke run SELinuxError: SELinux denials found on ubuntu@pluto006.ceph.redhat.com: ['type=AVC msg=audit(1466048150.488:2656): avc: denied { chown } for pid=12251 comm="radosgw" capability=0 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:system_r:ceph_t:s0 tclass=capability'] I believe this was recently fixed in master Version-Release number of selected component (if applicable): 10.2.2-2.el7cp (f1f313912893a3ecab6afbdc5690054dde9789fb) more logs: http://magna002.ceph.redhat.com/vasu-2016-06-15_19:14:50-smoke-jewel---basic-pluto/238903/teuthology.log
Boris, would you please look into this and prepare a patch for the selinux policy if necessary?
Vasu, what is the minimal reproduction case for this denial? I'd like to try to reproduce it outside of teuthology.
Vasu clarified that this is probably fixed by https://github.com/ceph/ceph/pull/9669 , so we will cherry-pick that downstream.
Yes, this should be fixed by the PR#9669.
Verified in 10.2.2
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-1755.html