Red Hat Bugzilla – Bug 1558656
SELinux is preventing /usr/sbin/snapperd from mounton access [rhel-7.5.z]
Last modified: 2018-04-10 15:14:56 EDT
This bug has been copied from bug #1556798 and has been proposed to be backported to 7.5 z-stream (EUS).
Our automated TC for snapper passes on x86_64 VM 1MT-RHEL-7.5-20180315.0 if the latest selinux-policy (3.13.1-192.el7_5.1) installed. Could you re-run your snapper tests and let us know, what are their results.
The same SELinux denial as mentioned in comment#7 we already saw in BZ#1063150. Our TC found out that following rules are missing: allow snapperd_t kernel_t : process { setsched }; allow snapperd_t fs_t : filesystem { mount }; The reason for switching this bug to ASSIGNED is that both rules should be present, but they are not. BZ#1063150 is closed as current release, therefore the rules should be present.
Jakub, Following line: allow snapperd_t kernel_t : process { setsched }; Is allowing snapperd to set priority for kernel threads. Is to okay? Snapperd is manipulating with kernel threads prio? THanks, Lukas.
Lukas, I lack the knowledge to answer this properly, this is more a question for Ondrej. Jakub
Snapperd is lowering priority of background tasks (threads) performing snapshot comparison. Both process priority and i/o priority are set (lowered). setpriority() syscall(SYS_ioprio_set,...)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1059