Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.
We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.
Reopening for reconsideration, on behalf of CEE Product Experience.
This needs to be fixed in RHEL 7. The RHEL High Availability Add-On offers the fence_mpath agent for users to select as a method to manage the membership state of nodes of their cluster. The SELinux denials here prevent that agent from performing its duties - and this leaves those cluster deployments at risk of not providing High Availability for their configured use case. And in most cases - this will only be discovered in production, as the same functionality won't be triggered during "normal" operations - only when the cluster is in a critical state requiring recovery operations to be carried out against a node.
The point is: This presents a risk for customers to lose access to mission critical services which is counter to the purpose of RHEL High Availability. The functionality that is blocked by this set of SELinux denials is already in customers hands, so we need SELinux to allow it.
It is unfortunate that the SELinux changes were not made at the same time as the user-functionality that was delivered, but we still need to deliver those policy changes to avoid the fallout with customers. We are already having to take special proactive measures to get out ahead of this with customers, and we need to deliver a fix so this isn't broken for the life of RHEL 7.
Can we please reevaluate the 7.7 decision? Is there something we in CEE Global Support can help with to verify this and/or move it forward?
Thanks,
John Ruemker
CEE Product Experience lead for RHEL High Availability
I'm fine with giving qa_ack+ to this bug, if QE person responsible for testing of fence-agents-mpath helps me to test the mpathpersist functionality.
I expect that /usr/sbin/mpathpersist gets some FS administration related label (like fsadm_t or lvm_t instead of bin_t) and a transition from watchdog_t to the FS administration related domain gets defined.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2019:2127