Bug 1371201 - [anaconda ibft] ibft plugin stopped working in 7.3 due to /sbin/iscsiadm failing.
Summary: [anaconda ibft] ibft plugin stopped working in 7.3 due to /sbin/iscsiadm fail...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: NetworkManager
Version: 7.2
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Thomas Haller
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks: 1375948
TreeView+ depends on / blocked
 
Reported: 2016-08-29 14:37 UTC by Radek Vykydal
Modified: 2016-11-03 19:29 UTC (History)
9 users (show)

Fixed In Version: NetworkManager-1.4.0-5.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1375948 (view as bug list)
Environment:
Last Closed: 2016-11-03 19:29:14 UTC


Attachments (Terms of Use)
NetworkManager log (121.50 KB, text/plain)
2016-08-29 14:37 UTC, Radek Vykydal
no flags Details
strace output of failure (22.72 KB, text/plain)
2016-09-02 09:08 UTC, Thomas Haller
no flags Details
strace output of success (55.55 KB, text/plain)
2016-09-02 10:26 UTC, Thomas Haller
no flags Details
[patch] document CAP_SYS_ADMIN requirement for upstream (1.79 KB, patch)
2016-09-02 11:37 UTC, Thomas Haller
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2581 normal SHIPPED_LIVE Low: NetworkManager security, bug fix, and enhancement update 2016-11-03 12:08:07 UTC
Red Hat Bugzilla 1309661 None CLOSED For static iBFT configuration editable ibft0 connection is exposed in Anaconda UI 2019-07-10 12:42:54 UTC

Internal Links: 1309661

Description Radek Vykydal 2016-08-29 14:37:18 UTC
Created attachment 1195406 [details]
NetworkManager log

During 7.3 development NM ibft plugin stopped being able to read iBFT info using iscsiadm:

Aug 29 14:28:48 localhost NetworkManager[1431]: <debug> [1472480928.2287] ibft: failed to read iscsiadm records: iBFT: /sbin/iscsiadm exited with error 21.  Message: 'iscsiadm: Could not get list of targets from firmware. (err 21) '

Attaching NM log

/sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment

/sbin/iscsiadm -m fw
works in installer environment from tty2 shell

Comment 2 Thomas Haller 2016-08-29 15:07:29 UTC
according to manual page, err 21 means
  "ISCSI_ERR_NO_OBJS_FOUND - no records/targets/sessions/portals found to execute 
   operation on."

NetworkManager doesn't do much special except calling "/sbin/iscsiadm -m fw".

Comment 3 Radek Vykydal 2016-08-30 12:13:40 UTC
(In reply to Radek Vykydal from comment #0)

> 
> /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment

correction:

/sbin is a symlink to /usr/sbin

Comment 4 Thomas Haller 2016-09-02 09:03:18 UTC
seems to be due to CapabilityBoundingSet in NetworkManager.service.


I created a test service /etc/systemd/system/test-iscsiadm.service


[Unit]
Description=Test iscsiadm (created by Thomas Haller, 2016-09-02)
[Service]
Type=oneshot
ExecStart=/sbin/iscsiadm -m fw
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
ProtectSystem=true
ProtectHome=read-only


which fails with the present CapabilityBoundingSet.

Comment 5 Thomas Haller 2016-09-02 09:08:13 UTC
Created attachment 1197080 [details]
strace output of failure

Created with above test-service and "ExecStart=/usr/bin/strace /sbin/iscsiadm -m fw"

Comment 6 Thomas Haller 2016-09-02 10:26:35 UTC
Created attachment 1197110 [details]
strace output of success

same, but with no CapabilityBoundingSet

Comment 7 Thomas Haller 2016-09-02 11:30:38 UTC
seems we need CAP_SYS_ADMIN:

# capsh '--drop=CAP_SYS_ADMIN' -- -c 'cat /sys/firmware/ibft/target0/flags'
cat: /sys/firmware/ibft/target0/flags: Permission denied


Adding CAP_SYS_ADMIN to NetworkManager.service kinda defeats the main purpose. Still, for rhel-7.2 we didn't have any restriction at all. It seems better to add the extra capability then break ibft.

Comment 8 Thomas Haller 2016-09-02 11:37:05 UTC
Created attachment 1197124 [details]
[patch] document CAP_SYS_ADMIN requirement for upstream

Comment 11 Vladimir Benes 2016-09-20 22:39:46 UTC
CapabilityBoundingSet now contains CAP_SYS_ADMIN in .service file.

Comment 13 errata-xmlrpc 2016-11-03 19:29:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2581.html


Note You need to log in before you can comment on or make changes to this bug.