Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1865762

Summary: [RHEL][IBM] CephFS Volume has Permission Denied error while mounting
Product: Red Hat Enterprise Linux 8 Reporter: Humble Chirammal <hchiramm>
Component: container-selinuxAssignee: Daniel Walsh <dwalsh>
Status: CLOSED NOTABUG QA Contact: atomic-bugs <atomic-bugs>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.0CC: akgunjal, assingh, dornelas, dwalsh, ebenahar, ekuric, hchiramm, jarrpa, jnovy, lvrabec, madam, mmalik, nberry, ocs-bugs, plautrba, ratamir, sabose, sostapov, ssekidde, tsweeney, uchapaga
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: 8.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1845166 Environment:
Last Closed: 2021-01-28 11:15:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1845166    

Comment 1 Humble Chirammal 2020-08-04 05:00:20 UTC 
To summarize:

`container_use_cephfs` SELinux boolean has to be enabled in RHEL for Ceph to work correctly in OCS + OCP deployments. Can we please enable it by default in RHEL ?
Comment 2 Milos Malik 2020-08-04 07:19:59 UTC 
The selinux-policy packages shipped in RHEL do not define any container_use_cephfs boolean. I believe this bug should be switched to container-selinux component.
Comment 3 Milos Malik 2020-08-04 07:22:41 UTC 
After installation of the container-selinux package on a RHEL-8.x machine, the container_use_cephfs boolean appears.
Comment 4 Lukas Vrabec 2020-08-04 07:34:50 UTC 
As Milos mentioned container_use_cephfs is defined in container-selinux rpm package. 
https://github.com/containers/container-selinux/blob/master/container.te#L32

Switching component from selinux-policy to container-selinux.
Comment 6 Humble Chirammal 2020-10-05 10:44:47 UTC 
(In reply to Lukas Vrabec from comment #4)
> As Milos mentioned container_use_cephfs is defined in container-selinux rpm
> package. 
> https://github.com/containers/container-selinux/blob/master/container.te#L32
> 
> Switching component from selinux-policy to container-selinux.

Thanks Milos and Lukas. considering this is hitting good number of customers, can we please prioritize this fix in container-selinux.
Comment 7 Yaniv Kaul 2020-11-30 15:39:07 UTC 
(In reply to Humble Chirammal from comment #6)
> (In reply to Lukas Vrabec from comment #4)
> > As Milos mentioned container_use_cephfs is defined in container-selinux rpm
> > package. 
> > https://github.com/containers/container-selinux/blob/master/container.te#L32
> > 
> > Switching component from selinux-policy to container-selinux.
> 
> Thanks Milos and Lukas. considering this is hitting good number of
> customers, can we please prioritize this fix in container-selinux.

Any updates?
Comment 8 Daniel Walsh 2020-12-01 20:27:59 UTC 
If openshift wants to enable this boolean by default, I am all for it.

I don't see a reason to enable it by default in container-selinux.
Comment 9 Tom Sweeney 2020-12-01 20:55:51 UTC 
Derrick,

Given the previous comment from Dan, can/should we move this to OpenShift?  Or do you know who from that group we could get to weigh in on this thought?
Comment 10 Derrick Ornelas 2020-12-09 18:42:22 UTC 
The selinux boolean is already enabled by default on RHEL CoreOS starting with OCP 4.1 (BZ 1694045). I think this bug is specifically about enabling it by default in RHEL 8.  

Humble, is this issue specific to ROKS which I believe only uses RHEL 7 and not RHCOS?  If you're using RHCOS this should just work.
Comment 11 Daniel Walsh 2021-01-28 11:15:55 UTC 
This looks like it works as planned.
I am closing this as notabug
Comment 12 Red Hat Bugzilla 2023-09-15 00:46:01 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days