Hide Forgot
Created attachment 1195406 [details] NetworkManager log During 7.3 development NM ibft plugin stopped being able to read iBFT info using iscsiadm: Aug 29 14:28:48 localhost NetworkManager[1431]: <debug> [1472480928.2287] ibft: failed to read iscsiadm records: iBFT: /sbin/iscsiadm exited with error 21. Message: 'iscsiadm: Could not get list of targets from firmware. (err 21) ' Attaching NM log /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment /sbin/iscsiadm -m fw works in installer environment from tty2 shell
according to manual page, err 21 means "ISCSI_ERR_NO_OBJS_FOUND - no records/targets/sessions/portals found to execute operation on." NetworkManager doesn't do much special except calling "/sbin/iscsiadm -m fw".
(In reply to Radek Vykydal from comment #0) > > /sbin/iscsiadm is a symlink to /usr/sbin/iscsiadm in installer environment correction: /sbin is a symlink to /usr/sbin
seems to be due to CapabilityBoundingSet in NetworkManager.service. I created a test service /etc/systemd/system/test-iscsiadm.service [Unit] Description=Test iscsiadm (created by Thomas Haller, 2016-09-02) [Service] Type=oneshot ExecStart=/sbin/iscsiadm -m fw CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT ProtectSystem=true ProtectHome=read-only which fails with the present CapabilityBoundingSet.
Created attachment 1197080 [details] strace output of failure Created with above test-service and "ExecStart=/usr/bin/strace /sbin/iscsiadm -m fw"
Created attachment 1197110 [details] strace output of success same, but with no CapabilityBoundingSet
seems we need CAP_SYS_ADMIN: # capsh '--drop=CAP_SYS_ADMIN' -- -c 'cat /sys/firmware/ibft/target0/flags' cat: /sys/firmware/ibft/target0/flags: Permission denied Adding CAP_SYS_ADMIN to NetworkManager.service kinda defeats the main purpose. Still, for rhel-7.2 we didn't have any restriction at all. It seems better to add the extra capability then break ibft.
Created attachment 1197124 [details] [patch] document CAP_SYS_ADMIN requirement for upstream
CapabilityBoundingSet now contains CAP_SYS_ADMIN in .service file.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2581.html