Description of problem: ======================= Unable to export volume via ganesha when selinux is set as "Enforcing" # gluster v set ganesha ganesha.enable on volume set: success # showmount -e Export list for dhcp35-21.lab.eng.blr.redhat.com: Following AVC's were observed- # cat /var/log/audit/audit.log | grep AVC|grep ganesha type=USER_AVC msg=audit(1587417579.187:32618): pid=1107 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=signal interface=org.ganesha.nfsd.exportmgr member=AddExport dest=org.ganesha.nfsd spid=997453 tpid=995874 scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:system_r:ganesha_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus" Version-Release number of selected component (if applicable): ============================================================= # rpm -qa | grep ganesha nfs-ganesha-gluster-2.7.3-13.el8rhgs.x86_64 nfs-ganesha-debuginfo-2.7.3-13.el8rhgs.x86_64 nfs-ganesha-debugsource-2.7.3-13.el8rhgs.x86_64 nfs-ganesha-gluster-debuginfo-2.7.3-13.el8rhgs.x86_64 nfs-ganesha-selinux-2.7.3-13.el8rhgs.noarch glusterfs-ganesha-6.0-32.el8rhgs.x86_64 nfs-ganesha-2.7.3-13.el8rhgs.x86_64 How reproducible: ================= 2/2 Steps to Reproduce: ================== 1.Create 4 node ganesha cluster 2.Create a volume 3.Export the volume via ganesha Actual results: ============== Unable to export volume via ganesha in ENFORCING mode. Volume export is successful when selinux is set in PERMISSIVE mode Expected results: ================= Volume export should work when selinux is set in ENFORCING mode Additional info:
https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/490517
Verified this BZ with # rpm -qa | grep ganesha nfs-ganesha-2.7.3-14.el8rhgs.x86_64 nfs-ganesha-debugsource-2.7.3-14.el8rhgs.x86_64 nfs-ganesha-gluster-2.7.3-14.el8rhgs.x86_64 nfs-ganesha-gluster-debuginfo-2.7.3-14.el8rhgs.x86_64 nfs-ganesha-debuginfo-2.7.3-14.el8rhgs.x86_64 glusterfs-ganesha-6.0-32.el8rhgs.x86_64 nfs-ganesha-selinux-2.7.3-14.el8rhgs.noarch ----------------------- # getenforce Enforcing # gluster v set ganesha ganesha.enable on volume set: success [root@dhcp35-21 ganesha]# showmount -e Export list for dhcp35-21.lab.eng.blr.redhat.com: /ganesha (everyone) [root@dhcp35-21 ganesha]# cat /var/log/audit/audit.log | grep AVC | grep ganesha ---------------------- Moving this BZ to verified state
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2576