1455631 – sbd daemon can not access /proc/sysrq-trigger

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1455631 - sbd daemon can not access /proc/sysrq-trigger

Summary: sbd daemon can not access /proc/sysrq-trigger

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	selinux-policy
Sub Component:
Version:	7.4
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	Lukas Vrabec
QA Contact:	Milos Malik
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1413951
TreeView+	depends on / blocked

Reported:	2017-05-25 16:20 UTC by Miroslav Lisik
Modified:	2017-08-01 15:26 UTC (History)
CC List:	8 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2017-08-01 15:26:23 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Bugzilla	1440165	0	high	CLOSED	SELinux policy (daemons) changes required for package: sbd - due to enabling block-device support	2021-02-22 00:41:40 UTC
Red Hat Product Errata	RHBA-2017:1861	0	normal	SHIPPED_LIVE	selinux-policy bug fix update	2017-08-01 17:50:24 UTC

Internal Links: 1440165

Description Miroslav Lisik 2017-05-25 16:20:15 UTC

Description of problem:

SE-Linux prevents sbd from accessing the /proc/sysrq-trigger.

Version-Release number of selected component (if applicable):

# rpm -qa selinux\*
selinux-policy-3.13.1-151.el7.noarch
selinux-policy-targeted-3.13.1-151.el7.noarch
selinux-policy-devel-3.13.1-151.el7.noarch

How reproducible:
always

Steps to Reproduce:

1. install sbd package

[root@virt-146 ~]# yum -y -q install sbd

2. Change sbd configuration file at /etc/sysconfig/sbd, set SBD_DEVICE to your testing device

[root@virt-146 ~]# cat > /etc/sysconfig/sbd <<EOF
> SBD_DELAY_START=no
> SBD_DEVICE="/dev/sda"
> SBD_PACEMAKER=yes
> SBD_STARTMODE=always
> SBD_WATCHDOG_DEV=/dev/null
> SBD_WATCHDOG_TIMEOUT=5
> EOF

3. Create sbd header on the block device.

[root@virt-146 ~]# sbd -d /dev/sda create
Initializing device /dev/sda
Creating version 2.1 header on device 4 (uuid: 9f69bcb1-f563-4095-9b2f-31515d833398)
Initializing 255 slots on device 4
Device /dev/sda is initialized.

4. Modify sbd.service file to enable start service manualy.

 [root@virt-146 ~]# sed -i "s/^RefuseManualStart=.*$/RefuseManualStart=false/" /usr/lib/systemd/system/sbd.service
[root@virt-146 ~]# sed -i "s/^RefuseManualStop=.*$/RefuseManualStop=false/" /usr/lib/systemd/system/sbd.service
[root@virt-146 ~]# systemctl daemon-reload

5. Start the sbd service:
[root@virt-146 ~]# systemctl start sbd
[root@virt-146 ~]# systemctl status sbd
● sbd.service - Shared-storage based fencing daemon
   Loaded: loaded (/usr/lib/systemd/system/sbd.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2017-05-25 18:01:49 CEST; 2s ago
  Process: 11976 ExecStart=/usr/sbin/sbd $SBD_OPTS -p /var/run/sbd.pid watch (code=exited, status=0/SUCCESS)
 Main PID: 11977 (sbd)
   CGroup: /system.slice/sbd.service
           ├─11977 sbd: inquisitor
           ├─11978 sbd: watcher: /dev/sda - slot: 0 - uuid: 91c62c77-bd37-40be-9cfc-a2c93dce646c
           ├─11979 sbd: watcher: Pacemaker
           └─11980 sbd: watcher: Cluster

May 25 18:01:46 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: Starting Shared-storage bas....
May 25 18:01:49 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: Started Shared-storage base....
Hint: Some lines were ellipsized, use -l to show in full.

6. Write 'reset' message to the slot on the sbd device (use sbd's list command to get the slot name).

[root@virt-146 ~]# sbd -d /dev/sda list
0       virt-146.cluster-qe.lab.eng.brq.redhat.com      clear   
[root@virt-146 ~]# sbd -d /dev/sda message virt-146.cluster-qe.lab.eng.brq.redhat.com reset

7. Check the avc messages

Actual results:

Following SELinux denial appeared in enforcing mode:

----
time->Thu May 25 18:02:34 2017
type=PROCTITLE msg=audit(1495728154.529:3357): proctitle=7362643A20776174636865723A202F6465762F736461202D20736C6F743A2030202D20757569643A2039316336326337372D626433372D343062652D396366632D613263393364636536343663
type=SYSCALL msg=audit(1495728154.529:3357): arch=c000003e syscall=2 success=no exit=-13 a0=40bcb0 a1=441 a2=1b6 a3=24 items=0 ppid=11977 pid=11978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sbd" exe="/usr/sbin/sbd" subj=system_u:system_r:sbd_t:s0 key=(null)
type=AVC msg=audit(1495728154.529:3357): avc:  denied  { append } for  pid=11978 comm="sbd" name="sysrq-trigger" dev="proc" ino=4026532058 scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=file
----
time->Thu May 25 18:02:34 2017
type=PROCTITLE msg=audit(1495728154.530:3358): proctitle=7362643A20776174636865723A202F6465762F736461202D20736C6F743A2030202D20757569643A2039316336326337372D626433372D343062652D396366632D613263393364636536343663
type=SYSCALL msg=audit(1495728154.530:3358): arch=c000003e syscall=169 success=no exit=-1 a0=fffffffffee1dead a1=28121969 a2=1234567 a3=7ffe588f0d60 items=0 ppid=11977 pid=11978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sbd" exe="/usr/sbin/sbd" subj=system_u:system_r:sbd_t:s0 key=(null)
type=AVC msg=audit(1495728154.530:3358): avc:  denied  { sys_boot } for  pid=11978 comm="sbd" capability=22  scontext=system_u:system_r:sbd_t:s0 tcontext=system_u:system_r:sbd_t:s0 tclass=capability

Expected results:

No AVC messages.
The sbd daemon should be allowed to write into /proc/sysrq-trigger and machine should reboot.



-------------------------------------------------------
Additional info:

a) No AVC messages in the permissive mode because machine immediately reboots.

b) 'reset' message was writen:

[root@virt-146 ~]# sbd -d /dev/sda list
0       virt-146.cluster-qe.lab.eng.brq.redhat.com      reset   virt-146.cluster-qe.lab.eng.brq.redhat.com

c) status of sbd daemon

[root@virt-146 ~]# systemctl status sbd
● sbd.service - Shared-storage based fencing daemon
   Loaded: loaded (/usr/lib/systemd/system/sbd.service; disabled; vendor preset: disabled)
   Active: failed (Result: timeout) since Thu 2017-05-25 18:04:12 CEST; 3min 6s ago
  Process: 12117 ExecStop=/usr/bin/kill -TERM $MAINPID (code=exited, status=1/FAILURE)
  Process: 11976 ExecStart=/usr/sbin/sbd $SBD_OPTS -p /var/run/sbd.pid watch (code=exited, status=0/SUCCESS)
 Main PID: 11977 (code=exited, status=1/FAILURE)

May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: -p, --pid              print pids without signaling them
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: -l, --list [=<signal>] list signal names, or convert one to a name
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: -L, --table            list signal names and numbers
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: -h, --help     display this help and exit
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: -V, --version  output version information and exit
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com kill[12117]: For more details see kill(1).
May 25 18:02:42 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: sbd.service: control process exited, code=exited status=1
May 25 18:04:12 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: sbd.service stop-sigterm timed out. Killing.
May 25 18:04:12 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: Unit sbd.service entered failed state.
May 25 18:04:12 virt-146.cluster-qe.lab.eng.brq.redhat.com systemd[1]: sbd.service failed.

d) snippet from /var/log/messages:

May 25 18:01:46 virt-146 systemd: Starting Shared-storage based fencing daemon...
May 25 18:01:49 virt-146 systemd: Started Shared-storage based fencing daemon.
May 25 18:02:34 virt-146 sbd[11978]:  /dev/sda:    emerg: do_exit: Rebooting system: reboot
May 25 18:02:34 virt-146 sbd[11978]:  /dev/sda:    error: sysrq_trigger: Opening sysrq-trigger failed.: Permission denied (13)
May 25 18:02:34 virt-146 sbd[11978]:  /dev/sda:    error: do_exit: Reboot failed: Operation not permitted (1)
May 25 18:02:34 virt-146 sbd[11977]: warning: cleanup_servant_by_pid: Servant for /dev/sda (pid: 11978) has terminated
May 25 18:02:35 virt-146 sbd[12091]:  /dev/sda:    emerg: do_exit: Rebooting system: reboot
May 25 18:02:35 virt-146 sbd[12091]:  /dev/sda:    error: sysrq_trigger: Opening sysrq-trigger failed.: Permission denied (13)
May 25 18:02:35 virt-146 sbd[12091]:  /dev/sda:    error: do_exit: Reboot failed: Operation not permitted (1)
May 25 18:02:35 virt-146 sbd[11977]: warning: cleanup_servant_by_pid: Servant for /dev/sda (pid: 12091) has terminated
May 25 18:02:40 virt-146 sbd[11977]: warning: inquisitor_child: Latency: No liveness for 4 s exceeds threshold of 3 s (healthy servants: 0)
May 25 18:02:41 virt-146 sbd[11977]: warning: inquisitor_child: Latency: No liveness for 5 s exceeds threshold of 3 s (healthy servants: 0)
May 25 18:02:41 virt-146 sbd[12109]:  /dev/sda:    emerg: do_exit: Rebooting system: reboot
May 25 18:02:41 virt-146 sbd[12109]:  /dev/sda:    error: sysrq_trigger: Opening sysrq-trigger failed.: Permission denied (13)
May 25 18:02:41 virt-146 sbd[12109]:  /dev/sda:    error: do_exit: Reboot failed: Operation not permitted (1)
May 25 18:02:41 virt-146 sbd[11977]: warning: cleanup_servant_by_pid: Servant for /dev/sda (pid: 12109) has terminated
May 25 18:02:41 virt-146 sbd[11977]: warning: inquisitor_child: Latency: No liveness for 5 s exceeds threshold of 3 s (healthy servants: 0)
May 25 18:02:41 virt-146 sbd[11977]: warning: inquisitor_child: Latency: No liveness for 5 s exceeds threshold of 3 s (healthy servants: 0)
May 25 18:02:42 virt-146 sbd[11977]:   emerg: do_exit: Rebooting system: reboot
May 25 18:02:42 virt-146 sbd[11977]:   error: sysrq_trigger: Opening sysrq-trigger failed.: Permission denied (13)
May 25 18:02:42 virt-146 sbd[11977]:   error: do_exit: Reboot failed: Operation not permitted (1)
May 25 18:02:42 virt-146 systemd: sbd.service: main process exited, code=exited, status=1/FAILURE
May 25 18:02:42 virt-146 kill: Usage:
May 25 18:02:42 virt-146 kill: kill [options] <pid|name> [...]
May 25 18:02:42 virt-146 kill: Options:
May 25 18:02:42 virt-146 kill: -a, --all              do not restrict the name-to-pid conversion to processes
May 25 18:02:42 virt-146 kill: with the same uid as the present process
May 25 18:02:42 virt-146 kill: -s, --signal <sig>     send specified signal
May 25 18:02:42 virt-146 kill: -q, --queue <sig>      use sigqueue(2) rather than kill(2)
May 25 18:02:42 virt-146 kill: -p, --pid              print pids without signaling them
May 25 18:02:42 virt-146 kill: -l, --list [=<signal>] list signal names, or convert one to a name
May 25 18:02:42 virt-146 kill: -L, --table            list signal names and numbers
May 25 18:02:42 virt-146 kill: -h, --help     display this help and exit
May 25 18:02:42 virt-146 kill: -V, --version  output version information and exit
May 25 18:02:42 virt-146 kill: For more details see kill(1).
May 25 18:02:42 virt-146 systemd: sbd.service: control process exited, code=exited status=1
May 25 18:04:12 virt-146 systemd: sbd.service stop-sigterm timed out. Killing.
May 25 18:04:12 virt-146 systemd: Unit sbd.service entered failed state.
May 25 18:04:12 virt-146 systemd: sbd.service failed.

Comment 7 errata-xmlrpc 2017-08-01 15:26:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861

Note You need to log in before you can comment on or make changes to this bug.