Bug 1627862

This may be related to Bug 1622236, but I can't explain why I didn't see this issue in the earlier versions of Rhel 7.6.

Hello HPE,
Please conform if you install RHEL 7.6 Snap 1 on the exact same system this issue does not occur?

Please attach a sosreport from the server seeing this issue.

Thank You
Joe Kachuck

Created attachment 1482481 [details]
sos report

Attaching sos report from fbolt01 (DL580 Gen10)

I did not see this issue when running Snap 1 on fbolt01.

Will CC Randy Wright who also starting seeing this issue on Snap 2 on his systems and Patrick who reported similar issue earlier.

I can confirm two systems installed with RHEL76 snap2 today see this issue, and did not previously see it with RHEL76 snap1.   One was a fresh install via PXE, you have an sosreport from that SUT attached to (probably unrelated) bug 1627908 I filed earlier today.

The other SUT was upgraded from snap1 to snap2 via editing yum.repos.d files and running yum upgrade, on that one also the "mmap failed: Permission denied" messages appear only after the update.   Since this is an upgrade over the previous snap1, I still have the old /var/log/messages* files attesting to the changed behavior.   

What might be interesting from the upgrade case is this: I can now see there was exactly one failure of systemd-readahead when snap1 booted, which I never noticed  during snap1 testing:

Sep  6 10:22:50 dl360g91 systemd: Detected architecture x86-64.
Sep  6 10:22:50 dl360g91 systemd: Set hostname to <dl360g91>.
Sep  6 10:22:51 dl360g91 systemd-readahead[10768]: Failed to mmap shared memory segment: Permission denied
Sep  6 10:22:51 dl360g91 systemd: Started Create list of required static device nodes for the current kernel.
Sep  6 10:22:51 dl360g91 systemd: systemd-readahead-collect.service: main process exited, code=exited, status=1/FAILURE
Sep  6 10:22:51 dl360g91 systemd: Started Collect Read-Ahead Data.
Sep  6 10:22:51 dl360g91 systemd: Starting Remount Root and Kernel File Systems...

Note the message: systemd-readahead-collect.service: main process exited, code=exited, status=1/FAILURE

So perhaps that could have changed in snap2 is if the first thing that was failing in snap1 was fixed and thereby enabled the code to run that now in snap2 prints 1000's of "mmap failed" messages.

*** This bug has been marked as a duplicate of bug 1614169 ***

System Type : BL920s Gen8 With Intel Xeon E7-2800 v2 2800 MHz

On the above system, below messages are seen during system boot-up process. These messages seems to be little more different than what Jerry seen on DL580 Gen10.

From Console Logs:

[  162.547803] EDAC sbridge: Failed to register device with error -22.^M
[  162.587465] EDAC MC0: Giving out device to 'sb_edac.c' 'Ivy Bridge SrcID#0_Ha
#0': DEV 0000:0f:0e.0^M
[  162.592233] type=1400 audit(1536734444.499:4): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/etc/udev/hwdb.bin" dev="sda4" ino=70 sconte
xt=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:systemd_hwdb_etc_
t:s0 tclass=file permissive=0^M
[  162.592320] systemd-readahead[21620]: mmap(/etc/udev/hwdb.bin) failed: Permis
sion denied^M
[  162.596802] type=1400 audit(1536734444.504:5): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/usr/sbin/swapon" dev="sda4" ino=1176605 sco
ntext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s
0 tclass=file permissive=0^M
[  162.596819] systemd-readahead[21620]: mmap(/usr/sbin/swapon) failed: Permissi
on denied^M
[  162.597161] type=1400 audit(1536734444.504:6): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/etc/udev/udev.conf" dev="sda4" ino=1176907
scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:etc_t:s0 tc
lass=file permissive=0^M
[  162.597172] systemd-readahead[21620]: mmap(/etc/udev/udev.conf) failed: Permi
ssion denied^M
[  162.598885] type=1400 audit(1536734444.506:7): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/var/lib/systemd/random-seed" dev="sda4" ino
=1177057 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:in
it_var_lib_t:s0 tclass=file permissive=0^M
[  162.598902] systemd-readahead[21620]: mmap(/var/lib/systemd/random-seed) fail
ed: Permission denied^M
[  162.599221] type=1400 audit(1536734444.506:8): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/usr/lib/modules/3.10.0-940.el7.x86_64/kerne
l/drivers/cpufreq/acpi-cpufreq.ko.xz" dev="sda4" ino=1426213 scontext=system_u:s
ystem_r:readahead_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=fil
e permissive=0^M
[  162.599233] systemd-readahead[21620]: mmap(/usr/lib/modules/3.10.0-940.el7.x8
6_64/kernel/drivers/cpufreq/acpi-cpufreq.ko.xz) failed: Permission denied^M
[  162.599266] type=1400 audit(1536734444.506:9): avc:  denied  { map } for  pid
=21620 comm="systemd-readahe" path="/usr/lib/modules/3.10.0-940.el7.x86_64/kerne
l/drivers/cpufreq/pcc-cpufreq.ko.xz" dev="sda4" ino=1426217 scontext=system_u:sy
stem_r:readahead_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file
 permissive=0^M
[  162.599274] systemd-readahead[21620]: mmap(/usr/lib/modules/3.10.0-940.el7.x8
6_64/kernel/drivers/cpufreq/pcc-cpufreq.ko.xz) failed: Permission denied^M
[  162.599309] type=1400 audit(1536734444.506:10): avc:  denied  { map } for  pi
d=21620 comm="systemd-readahe" path="/usr/lib/modules/3.10.0-940.el7.x86_64/kern
el/drivers/dma/ioat/ioatdma.ko.xz" dev="sda4" ino=1426227 scontext=system_u:syst
em_r:readahead_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file p
ermissive=0^M
[  162.599316] systemd-readahead[21620]: mmap(/usr/lib/modules/3.10.0-940.el7.x8
6_64/kernel/drivers/dma/ioat/ioatdma.ko.xz) failed: Permission denied^M
[  162.599371] type=1400 audit(1536734444.506:11): avc:  denied  { map } for  pi
d=21620 comm="systemd-readahe" path="/usr/lib/modules/3.10.0-940.el7.x86_64/kern
el/drivers/misc/hpilo.ko.xz" dev="sda4" ino=1426400 scontext=system_u:system_r:r
eadahead_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file permiss
ive=0^M
..
...
...

Best regards,
Jeevan.

Jerry, Patrick, and Jeevan, 
JoeK said bug 1614169 is closed dup to bug 1460322 which we have access to it and this bug is fixed in RHEL7.6 snapshot-3 released yesterday. 

Patrick bug 1622236 RFE: Add a SELinux <file>:map permission

Please retest RHEL7.6 snapshot-3 and let me know it fixed all your bugs.

thank you,
trinh

Installed Rhel 7.6 Snapshot-3 on DL560 Gen 9 (tanerite01) which I saw issue with in Snapshot 2.  Booted system a couple times w/ selinux Enforcing. Not seeing the problem.

During OS boot, systemd-readahead messages seen with RHEL7.6 Snapshot-2,  are NOT seen with RHEL7.6 Snapshot-3 on System Type : BL920s Gen8 With Intel Xeon E7-2800 v2 2800 MHz

RHEL7.6 Snapshot_3 no longer shows the message I was getting earlier on a DL360 Gen10 box.