Created attachment 1195406 [details]
During 7.3 development NM ibft plugin stopped being able to read iBFT info using iscsiadm:
Aug 29 14:28:48 localhost NetworkManager: <debug> [1472480928.2287] ibft: failed to read iscsiadm records: iBFT: /sbin/iscsiadm exited with error 21. Message: 'iscsiadm: Could not get list of targets from firmware. (err 21) '
Attaching NM log
/sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment
/sbin/iscsiadm -m fw
works in installer environment from tty2 shell
according to manual page, err 21 means
"ISCSI_ERR_NO_OBJS_FOUND - no records/targets/sessions/portals found to execute
NetworkManager doesn't do much special except calling "/sbin/iscsiadm -m fw".
(In reply to Radek Vykydal from comment #0)
> /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment
/sbin is a symlink to /usr/sbin
seems to be due to CapabilityBoundingSet in NetworkManager.service.
I created a test service /etc/systemd/system/test-iscsiadm.service
Description=Test iscsiadm (created by Thomas Haller, 2016-09-02)
ExecStart=/sbin/iscsiadm -m fw
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
which fails with the present CapabilityBoundingSet.
Created attachment 1197080 [details]
strace output of failure
Created with above test-service and "ExecStart=/usr/bin/strace /sbin/iscsiadm -m fw"
Created attachment 1197110 [details]
strace output of success
same, but with no CapabilityBoundingSet
seems we need CAP_SYS_ADMIN:
# capsh '--drop=CAP_SYS_ADMIN' -- -c 'cat /sys/firmware/ibft/target0/flags'
cat: /sys/firmware/ibft/target0/flags: Permission denied
Adding CAP_SYS_ADMIN to NetworkManager.service kinda defeats the main purpose. Still, for rhel-7.2 we didn't have any restriction at all. It seems better to add the extra capability then break ibft.
Created attachment 1197124 [details]
[patch] document CAP_SYS_ADMIN requirement for upstream
CapabilityBoundingSet now contains CAP_SYS_ADMIN in .service file.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.