Bug 1773892
| Summary: | Set default policy for /var/lib/mysql to container_file_t | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Andreas Karis <akaris> |
| Component: | openstack-selinux | Assignee: | Julie Pichon <jpichon> |
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | nlevinki <nlevinki> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 13.0 (Queens) | CC: | cjeanner, lhh, lvrabec, zcaplovi |
| Target Milestone: | --- | Keywords: | Triaged, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-02-27 10:05:03 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Andreas Karis
2019-11-19 09:21:46 UTC
Thank you for the report. I would like to check with DFG:DF and/or DFG:PIDONE if that is the correct expectation for this directory. I think it is the case because I see that /var/lib/mysql is mounted with :z in current master THT: https://github.com/openstack/tripleo-heat-templates/blob/4cbae84/deployment/database/mysql-container-puppet.yaml#L130-L132 However the patch that added it (3eeece) was only released from tag 10.0.0 which wouldn't be available for 13 (8.4.1-13 is the latest, I think). 3eeece is a huge commit with probably too much extra impact, but perhaps it would make sense to backport the :z part just for the /var/lib/mysql line? Hello there, while the concern is valid for recent versions of OSP (osp-15 and newer), it's not valid for osp-13 nor osp-14. In fact, for those versions, the docker daemon has SELinux disabled, meaning the labels shouldn't be a concern at all (unless you see AVC in the audit.log?). The labels (and therefore flag ":z") are fully supported since osp-15 since we've moved to the podman container engine, which makes difficult to disable SELinux for containers (and, imho, it's better to have selinux there ;)). Care to check if you see AVC after your restorecon? If not, we won't do anything - if yes, it might require some work, but it probably won't hit openstack-selinux (not a big fan to add any override in there, to be honest). Cheers, C. Thank you for the additional information Cédric. Andreas, would it be possible to get the audit.log in permissive mode that shows the issues with the label? Hi Andreas. Any luck with getting the audit logs from a permissive run? Thank you. Closing due to missing the logs showing the issue. We wouldn't be able to change the context for these files in openstack-selinux as that would conflict with the mysqld_db_t file contexts from the default policy: # semanage fcontext -l | grep mysqld_db_t /var/lib/mysql(-files|-keyring)?(/.*)? all files system_u:object_r:mysqld_db_t:s0 but given AVC denials we should be able to add new rules. Please feel free to reopen once able to reproduce the issue in permissive and provide the missing logs. Thank you. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |