Bug 1544824 - [Ganesha] : Cluster creation fails on selinux enabled/enforced nodes.
Summary: [Ganesha] : Cluster creation fails on selinux enabled/enforced nodes.
Alias: None
Product: Red Hat Gluster Storage
Classification: Red Hat
Component: nfs-ganesha
Version: rhgs-3.4
Hardware: x86_64
OS: Linux
Target Milestone: ---
: RHGS 3.4.0
Assignee: Kaleb KEITHLEY
QA Contact: Manisha Saini
Depends On: 1544852
Blocks: 1503137
TreeView+ depends on / blocked
Reported: 2018-02-13 15:05 UTC by Ambarish
Modified: 2018-09-24 07:18 UTC (History)
10 users (show)

Fixed In Version: glusterfs-3.12.2-5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-09-04 06:42:41 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Bugzilla 1544852 None CLOSED build: glusterfs.spec %post ganesha is missing %{?rhel} test 2019-05-30 06:08:24 UTC
Red Hat Product Errata RHSA-2018:2607 None None None 2018-09-04 06:43:59 UTC

Internal Links: 1544852

Description Ambarish 2018-02-13 15:05:28 UTC
Description of problem:

gluster nfs-ganesha enable fails to create a Ganesha HA cluster on latest RHEL 7.5 Snapshot 3.

There's an AVC denial when I try to create a cluster :

type=AVC msg=audit(1518517089.008:203): avc:  denied  { search } for  pid=14039 comm="ganesha.nfsd" name="/" dev="fuse" ino=1 scontext=system_u:system_r:ganesha_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir

From ganesha.log :

13/02/2018 05:18:09 : epoch d6150000 : gqas004.sbu.lab.eng.bos.redhat.com : ganesha.nfsd-14038[main] main :MAIN :EVENT :ganesha.nfsd Starting: Ganesha Version 2.5.5
13/02/2018 05:18:09 : epoch d6150000 : gqas004.sbu.lab.eng.bos.redhat.com : ganesha.nfsd-14039[main] main :NFS STARTUP :CRIT :Error (token scan) while parsing (/etc/ganesha/ganesha.conf)
13/02/2018 05:18:09 : epoch d6150000 : gqas004.sbu.lab.eng.bos.redhat.com : ganesha.nfsd-14039[main] config_errs_to_log :CONFIG :CRIT :Config File (<unknown file>:0): new file (/etc/ganesha/ganesha.conf) open error (Permission denied), ignored
13/02/2018 05:18:09 : epoch d6150000 : gqas004.sbu.lab.eng.bos.redhat.com : ganesha.nfsd-14039[main] main :NFS STARTUP :FATAL :Fatal errors.  Server exiting...

Version-Release number of selected component (if applicable):

[root@gqas004 ~]# rpm -qa|grep ganesha

[root@gqas004 ~]# uname -r

[root@gqas004 ~]# rpm -qa|grep selinux

How reproducible:

2/2 (Manisha's and my setup)

Comment 2 Ambarish 2018-02-13 15:07:59 UTC
On a fresh install (IIRC) ganesha_use_fusefs is supposed to be "on".

For some reason , we do no see this option as "on":

[root@gqas004 ~]# getsebool  ganesha_use_fusefs
ganesha_use_fusefs --> off

Comment 3 Ambarish 2018-02-13 15:08:50 UTC
**Work Around** :

Set the boolean manually :

[root@gqas004 ~]# setsebool -P ganesha_use_fusefs on

[root@gqas004 ~]# getsebool  ganesha_use_fusefs
ganesha_use_fusefs --> on
[root@gqas004 ~]# 

Cluster creation is successful post this.

Comment 9 Manisha Saini 2018-04-03 05:43:08 UTC
Verified this BZ with-

# rpm -qa | grep ganesha

On fresh installation of ganesha packages in 3.4,ganesha_use_fusefs is ON by default.Ganesha cluster creation is successful.

# semanage boolean -l | grep ganesha
ganesha_use_fusefs             (on   ,   on)  Allow ganesha to use fusefs

Moving this BZ to verified state.

Comment 11 errata-xmlrpc 2018-09-04 06:42:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Comment 12 Manisha Saini 2018-09-24 07:18:11 UTC
Setting qe_test_coverage + with no testcase ID,since its been covered as part of every Ganesha test case

Note You need to log in before you can comment on or make changes to this bug.