Bug 1469133 - [GANESHA] While running posix compliance,cthon tests on ganesha mount selinux AVC's are observed [NEEDINFO]
[GANESHA] While running posix compliance,cthon tests on ganesha mount selinux...
Status: ASSIGNED
Product: Red Hat Gluster Storage
Classification: Red Hat
Component: nfs-ganesha (Show other bugs)
3.3
Unspecified Unspecified
medium Severity unspecified
: ---
: ---
Assigned To: Kaleb KEITHLEY
Manisha Saini
:
Depends On:
Blocks: 1494382
  Show dependency treegraph
 
Reported: 2017-07-10 08:54 EDT by Manisha Saini
Modified: 2017-12-13 21:35 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1494382 (view as bug list)
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
kkeithle: needinfo? (msaini)


Attachments (Terms of Use)

  None (edit)
Description Manisha Saini 2017-07-10 08:54:41 EDT
Description of problem:

While running posix compliance,cthon tests on ganesha mount, lots of selinux AVC's are observed.
But the is passed without any failures

Version-Release number of selected component (if applicable):
# rpm -qa | grep ganesha
glusterfs-ganesha-3.8.4-32.el7rhgs.x86_64
nfs-ganesha-2.4.4-10.el7rhgs.x86_64
nfs-ganesha-gluster-2.4.4-10.el7rhgs.x86_64
nfs-ganesha-debuginfo-2.4.4-10.el7rhgs.x86_64

selinux-policy-targeted-3.13.1-165.el7.noarch


How reproducible:
Consistently

Steps to Reproduce:
1.Create 4 node ganesha cluster.
2.Create a volume and export it via v4.Set selinux to Enforcing mode
3.Run posix compliance and cthon tests on mount point

Actual results:
Test is passed both posix compliance and cthon.

But many selinux AVC's are observed in audit.log

type=PROCTITLE msg=audit(07/10/2017 08:22:30.916:19304) : proctitle=/usr/bin/ganesha.nfsd -L /var/log/ganesha.log -f /etc/ganesha/ganesha.conf -N NIV_EVENT -E 6441057429414346752 
type=SYSCALL msg=audit(07/10/2017 08:22:30.916:19304) : arch=x86_64 syscall=stat success=no exit=EACCES(Permission denied) a0=0x7f383e905ba4 a1=0x7f37bb6ad510 a2=0x7f37bb6ad510 a3=0x2 items=0 ppid=1 pid=6187 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ganesha.nfsd exe=/usr/bin/ganesha.nfsd subj=system_u:system_r:ganesha_t:s0 key=(null) 
type=AVC msg=audit(07/10/2017 08:22:30.916:19304) : avc:  denied  { getattr } for  pid=6187 comm=ganesha.nfsd path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:ganesha_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file 
----
type=PROCTITLE msg=audit(07/10/2017 08:22:29.815:19300) : proctitle=/usr/bin/ganesha.nfsd -L /var/log/ganesha.log -f /etc/ganesha/ganesha.conf -N NIV_EVENT -E 6441057429414346752 
type=SYSCALL msg=audit(07/10/2017 08:22:29.815:19300) : arch=x86_64 syscall=stat success=no exit=EACCES(Permission denied) a0=0x7f383e905ba4 a1=0x7f37bfeb6530 a2=0x7f37bfeb6530 a3=0x6130323964376137 items=0 ppid=1 pid=6187 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ganesha.nfsd exe=/usr/bin/ganesha.nfsd subj=system_u:system_r:ganesha_t:s0 key=(null) 
type=AVC msg=audit(07/10/2017 08:22:29.815:19300) : avc:  denied  { getattr } for  pid=6187 comm=ganesha.nfsd path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:ganesha_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file 
----
type=PROCTITLE msg=audit(07/10/2017 08:22:30.891:19302) : proctitle=/usr/bin/ganesha.nfsd -L /var/log/ganesha.log -f /etc/ganesha/ganesha.conf -N NIV_EVENT -E 6441057429414346752 
type=SYSCALL msg=audit(07/10/2017 08:22:30.891:19302) : arch=x86_64 syscall=stat success=no exit=EACCES(Permission denied) a0=0x7f383e905ba4 a1=0x7f37beeb4530 a2=0x7f37beeb4530 a3=0x6130323964376137 items=0 ppid=1 pid=6187 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ganesha.nfsd exe=/usr/bin/ganesha.nfsd subj=system_u:system_r:ganesha_t:s0 key=(null) 
type=AVC msg=audit(07/10/2017 08:22:30.891:19302) : avc:  denied  { getattr } for  pid=6187 comm=ganesha.nfsd path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:ganesha_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file 

Expected results:
No AVC's should be observed

Additional info:
Comment 2 Manisha Saini 2017-07-10 08:57:18 EDT
Lukas,

Can you please provide your comment for this Bug.
There is no functionality affect ,just these AVC's are observed in audit.log
Comment 5 Kaleb KEITHLEY 2017-08-16 08:44:58 EDT
please clone to rhel/selinux

Note You need to log in before you can comment on or make changes to this bug.