Description of problem: The ceph-volume utility does not restore the SELinux context of newly mounted filesystems. This will result in an unlabelled or improperly labelled OSDs and a lot of avc denials. As a result, people will need to manually relabel the file-system upon deployment to avoid SELinux denials which can take a lot of time. Version-Release number of selected component (if applicable): Any How reproducible: Always Steps to Reproduce: 1. Deploy an OSD with ceph-volume 2. Check the audit.log for avc denials 3. Check the context of the mounted file-systems in /var/lib/ceph/osd/ Actual results: There are avc denials and the SELinux context is incorrect. Expected results: No avc denials, the SELinux context is ceph_var_lib_t. Additional info:
Moving this bug to verified, there is no avc denial messages in /var/log/audit/audit.log Verified in ceph version 12.2.5-37.el7cp (7bac42c43d4cdcca7d0c4233344f9a3932636341) luminous (stable)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:2819