Bug 1607798 - watchdog.d and fence_mpath python script
Summary: watchdog.d and fence_mpath python script
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.6
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Depends On: 1255020 1293384
Blocks: 1292071
TreeView+ depends on / blocked
Reported: 2018-07-24 09:48 UTC by Martin Juricek
Modified: 2019-08-06 12:52 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1293384
Last Closed: 2019-08-06 12:52:25 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Bugzilla 1504202 None None None 2019-07-11 09:55:57 UTC
Red Hat Knowledge Base (Solution) 3953811 Troubleshoot None fence_mpath with Watchdog fails when SELinux is Enforcing in RHEL HA Cluster 2019-03-01 15:43:05 UTC
Red Hat Product Errata RHBA-2019:2127 None None None 2019-08-06 12:52:46 UTC

Internal Links: 1504202

Comment 3 Zdenek Pytela 2019-02-28 19:27:52 UTC
This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.

Comment 4 John Ruemker 2019-03-01 14:42:56 UTC
Reopening for reconsideration, on behalf of CEE Product Experience. 

This needs to be fixed in RHEL 7.  The RHEL High Availability Add-On offers the fence_mpath agent for users to select as a method to manage the membership state of nodes of their cluster.  The SELinux denials here prevent that agent from performing its duties - and this leaves those cluster deployments at risk of not providing High Availability for their configured use case.  And in most cases - this will only be discovered in production, as the same functionality won't be triggered during "normal" operations - only when the cluster is in a critical state requiring recovery operations to be carried out against a node.  

The point is: This presents a risk for customers to lose access to mission critical services which is counter to the purpose of RHEL High Availability.  The functionality that is blocked by this set of SELinux denials is already in customers hands, so we need SELinux to allow it.  

It is unfortunate that the SELinux changes were not made at the same time as the user-functionality that was delivered, but we still need to deliver those policy changes to avoid the fallout with customers.  We are already having to take special proactive measures to get out ahead of this with customers, and we need to deliver a fix so this isn't broken for the life of RHEL 7.  

Can we please reevaluate the 7.7 decision?  Is there something we in CEE Global Support can help with to verify this and/or move it forward? 

John Ruemker
CEE Product Experience lead for RHEL High Availability

Comment 5 Milos Malik 2019-03-01 17:19:13 UTC
I'm fine with giving qa_ack+ to this bug, if QE person responsible for testing of fence-agents-mpath helps me to test the mpathpersist functionality.

I expect that /usr/sbin/mpathpersist gets some FS administration related label (like fsadm_t or lvm_t instead of bin_t) and a transition from watchdog_t to the FS administration related domain gets defined.

Comment 14 errata-xmlrpc 2019-08-06 12:52:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.