RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1371201 - [anaconda ibft] ibft plugin stopped working in 7.3 due to /sbin/iscsiadm failing.
Summary: [anaconda ibft] ibft plugin stopped working in 7.3 due to /sbin/iscsiadm fail...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: NetworkManager
Version: 7.2
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Thomas Haller
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks: 1375948
TreeView+ depends on / blocked
 
Reported: 2016-08-29 14:37 UTC by Radek Vykydal
Modified: 2016-11-03 19:29 UTC (History)
9 users (show)

Fixed In Version: NetworkManager-1.4.0-5.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1375948 (view as bug list)
Environment:
Last Closed: 2016-11-03 19:29:14 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
NetworkManager log (121.50 KB, text/plain)
2016-08-29 14:37 UTC, Radek Vykydal 		no flags Details
strace output of failure (22.72 KB, text/plain)
2016-09-02 09:08 UTC, Thomas Haller 		no flags Details
strace output of success (55.55 KB, text/plain)
2016-09-02 10:26 UTC, Thomas Haller 		no flags Details
[patch] document CAP_SYS_ADMIN requirement for upstream (1.79 KB, patch)
2016-09-02 11:37 UTC, Thomas Haller 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1309661 0 unspecified CLOSED For static iBFT configuration editable ibft0 connection is exposed in Anaconda UI 2023-09-14 03:18:06 UTC
Red Hat Product Errata RHSA-2016:2581 0 normal SHIPPED_LIVE Low: NetworkManager security, bug fix, and enhancement update 2016-11-03 12:08:07 UTC

Internal Links: 1309661

Description Radek Vykydal 2016-08-29 14:37:18 UTC 
Created attachment 1195406 [details]
NetworkManager log

During 7.3 development NM ibft plugin stopped being able to read iBFT info using iscsiadm:

Aug 29 14:28:48 localhost NetworkManager[1431]: <debug> [1472480928.2287] ibft: failed to read iscsiadm records: iBFT: /sbin/iscsiadm exited with error 21.  Message: 'iscsiadm: Could not get list of targets from firmware. (err 21) '

Attaching NM log

/sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment

/sbin/iscsiadm -m fw
works in installer environment from tty2 shell
Comment 2 Thomas Haller 2016-08-29 15:07:29 UTC 
according to manual page, err 21 means
  "ISCSI_ERR_NO_OBJS_FOUND - no records/targets/sessions/portals found to execute 
   operation on."

NetworkManager doesn't do much special except calling "/sbin/iscsiadm -m fw".
Comment 3 Radek Vykydal 2016-08-30 12:13:40 UTC 
(In reply to Radek Vykydal from comment #0)

> 
> /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment

correction:

/sbin is a symlink to /usr/sbin
Comment 4 Thomas Haller 2016-09-02 09:03:18 UTC 
seems to be due to CapabilityBoundingSet in NetworkManager.service.


I created a test service /etc/systemd/system/test-iscsiadm.service


[Unit]
Description=Test iscsiadm (created by Thomas Haller, 2016-09-02)
[Service]
Type=oneshot
ExecStart=/sbin/iscsiadm -m fw
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
ProtectSystem=true
ProtectHome=read-only


which fails with the present CapabilityBoundingSet.
Comment 5 Thomas Haller 2016-09-02 09:08:13 UTC 
Created attachment 1197080 [details]
strace output of failure

Created with above test-service and "ExecStart=/usr/bin/strace /sbin/iscsiadm -m fw"
Comment 6 Thomas Haller 2016-09-02 10:26:35 UTC 
Created attachment 1197110 [details]
strace output of success

same, but with no CapabilityBoundingSet
Comment 7 Thomas Haller 2016-09-02 11:30:38 UTC 
seems we need CAP_SYS_ADMIN:

# capsh '--drop=CAP_SYS_ADMIN' -- -c 'cat /sys/firmware/ibft/target0/flags'
cat: /sys/firmware/ibft/target0/flags: Permission denied


Adding CAP_SYS_ADMIN to NetworkManager.service kinda defeats the main purpose. Still, for rhel-7.2 we didn't have any restriction at all. It seems better to add the extra capability then break ibft.
Comment 8 Thomas Haller 2016-09-02 11:37:05 UTC 
Created attachment 1197124 [details]
[patch] document CAP_SYS_ADMIN requirement for upstream
Comment 11 Vladimir Benes 2016-09-20 22:39:46 UTC 
CapabilityBoundingSet now contains CAP_SYS_ADMIN in .service file.
Comment 13 errata-xmlrpc 2016-11-03 19:29:14 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2581.html
Note You need to log in before you can comment on or make changes to this bug.