Bug 2000106
| Summary: | pmproxy fails to start | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Marius Vollmer <mvollmer> |
| Component: | pcp | Assignee: | pcp-maint <pcp-maint> |
| Status: | CLOSED DUPLICATE | QA Contact: | Jan Kurik <jkurik> |
| Severity: | unspecified | Docs Contact: | Apurva Bhide <abhide> |
| Priority: | unspecified | ||
| Version: | 8.5 | CC: | agerstmayr, jkurik, mgoodwin, nathans |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-09-01 12:52:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
We encountered this in a CI test for Cockpit. With "setenforce 0", this test succeeds, but there are these additional unexpected audit messages:
audit: type=1400 audit(1630498107.135:6): avc: denied { search } for pid=2333 comm="pmdakvm" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=1
audit: type=1400 audit(1630498107.135:7): avc: denied { read } for pid=2333 comm="pmdakvm" name="kvm" dev="tracefs" ino=22552 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=1
audit: type=1400 audit(1630498107.135:8): avc: denied { open } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/tracing/events/kvm" dev="tracefs" ino=22552 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=1
audit: type=1400 audit(1630498107.135:9): avc: denied { read } for pid=2333 comm="pmdakvm" name="id" dev="tracefs" ino=23075 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498107.135:10): avc: denied { open } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/tracing/events/kvm/kvm_exit/id" dev="tracefs" ino=23075 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498107.135:11): avc: denied { getattr } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/tracing/events/kvm/kvm_exit/id" dev="tracefs" ino=23075 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498108.893:12): avc: denied { read } for pid=2333 comm="pmdakvm" name="kvm" dev="debugfs" ino=23261 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=dir permissive=1
audit: type=1400 audit(1630498108.893:13): avc: denied { read } for pid=2333 comm="pmdakvm" name="max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498108.893:14): avc: denied { open } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/kvm/max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498108.893:15): avc: denied { getattr } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/kvm/max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498112.710:20): avc: denied { dac_override } for pid=3691 comm="pmproxy" capability=1 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:system_r:pcp_pmproxy_t:s0 tclass=capability permissive=1
audit: type=1400 audit(1630498112.710:21): avc: denied { read } for pid=3691 comm="pmproxy" name="disable_ipv6" dev="proc" ino=38682 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498112.710:22): avc: denied { open } for pid=3691 comm="pmproxy" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=38682 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498112.710:23): avc: denied { getattr } for pid=3691 comm="pmproxy" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=38682 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498112.748:24): avc: denied { name_connect } for pid=3691 comm="pmproxy" dest=6379 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:redis_port_t:s0 tclass=tcp_socket permissive=1
audit: type=1400 audit(1630498170.381:25): avc: denied { read } for pid=2333 comm="pmdakvm" name="kvm" dev="debugfs" ino=23261 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=dir permissive=1
audit: type=1400 audit(1630498170.381:26): avc: denied { read } for pid=2333 comm="pmdakvm" name="max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498170.381:27): avc: denied { open } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/kvm/max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
audit: type=1400 audit(1630498170.381:28): avc: denied { getattr } for pid=2333 comm="pmdakvm" path="/sys/kernel/debug/kvm/max_mmu_page_hash_collisions" dev="debugfs" ino=23303 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
This is a duplicate of bz1998491. Please use pcp-5.3.1-5.el8 build, which fixes this issue. *** This bug has been marked as a duplicate of bug 1998491 *** |
Description of problem: "systemctl start pmproxy" fails, probably because of SELinux. Version-Release number of selected component (if applicable): pcp-5.3.1-4.el8.x86_64 selinux-policy-3.14.3-78.el8.noarch How reproducible: Always Steps to Reproduce: 1. systemctl start pmproxy Actual results: pmproxy.service fails to start with these messages: Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: pmproxy: cannot open log "pmproxy.log" for writing : Permission denied Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: Log for pmproxy on rhel-8-5-127-0-0-2-2201 started Wed Sep 1 07:56:41 2021 Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: pmproxy: instrumentation disabled Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: pmproxy: local listen error invalid argument Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: Error: cannot open PID file /run/pcp/pmproxy.pid Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: [Wed Sep 1 07:56:41] pmproxy(1516) Error: pmproxy not started due to errors! Sep 01 07:56:41 rhel-8-5-127-0-0-2-2201 pmproxy[1516]: Log finished Wed Sep 1 07:56:41 2021 and these audit messages: [ 29.987267] audit: type=1400 audit(1630497401.007:4): avc: denied { dac_override } for pid=1371 comm="pmproxy" capability=1 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:system_r:pcp_pmproxy_t:s0 tclass=capability permissive=0 [ 29.991112] audit: type=1400 audit(1630497401.007:5): avc: denied { read } for pid=1371 comm="pmproxy" name="disable_ipv6" dev="proc" ino=33186 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0 Expected results: pmproxy.service starts Additional info: After "setenforce 0", pmproxy.service starts and works as expected.