Description of problem: ********************************* On a samba setup , if the statedump command is executed to collect the statedump on gfapi side , the file is not getting dumped to the location /var/run/gluster. There are two issues observed : 1. One is the /var/run/gluster doesn't have write permission. 2. SELINUX is preventing smbd to write to /var/run/gluster the 1st issue is been discussed in upstream and there is another bug which may track it. For 2nd issue we need SELinux policy to set context for smbd to access and write to /var/run/gluster After setting the SELinux to permissive and providing permission to user, it was able to dump. We need to check on default path for dumping statedump as this issue may occur even with non-root user as well. Version-Release number of selected component (if applicable): ********************************************* glusterfs-3.8.4-23.el7rhgs.x86_64 How reproducible: **************************** Always Steps to Reproduce: **************************** 1. Create a samba setup 2. mount a volume, run some I/O's 3. Run statedump command as following and check for the file: gluster volume statedump testvol client 10.70.47.45:32036 Actual results: *************************** The file is not getting dumped in default location due to SELINUX preventing smbd to access and write to /var/run/gluster. type=AVC msg=audit(1493119101.557:152328): avc: denied { write } for pid=32043 comm="smbd" name="gluster" dev="tmpfs" ino=14636 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:glusterd_var_run_t:s0 tclass=dir Expected results: **************************** statedump should succeed and dumps the file in /var/run/gluster. Additional info: ********************* How are we going to handle the permissions on this location? May be change the default location to /var/log/glusterfs?
This needs to be addressed in the selinux-policy package. Any process using libgfapi.so should have SELinux permissions to create new files under /var/run/gluster/ We could think about changing the default location of the statedumps, but that will affect other tools that try to collect those files. It probably is a good idea to give gfapi users the option to select a different directory. The directory probably needs to be different per application, otherwise the new default location will likely have problems with other applications...
Bug 1447669 has been reported to get a fix in selinux-policy for RHEL7. If this problem exists on RHEL6 too, an additional big for RHEL6/selinux-policy needs to be filed.
Validated the bug against RHEL7 and i was able to get statedump in the default location i.e /var/run/gluster when selinux is Enforcing. Followed the steps to reproduce gluster volume statedump <VOLNAME> client localhost:<smbd_pid>. However it is failing in RHEL6 for which we have a separate bug : #1461044