Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 2026953

Summary: /etc/pki/ca-trust/extracted selinux context modified when mon or rgw containers are started
Product: [Red Hat Storage] Red Hat Ceph Storage Reporter: Teoman ONAY <tonay>
Component: Ceph-AnsibleAssignee: Teoman ONAY <tonay>
Status: CLOSED ERRATA QA Contact: Ameena Suhani S H <amsyedha>
Severity: medium Docs Contact:
Priority: high    
Version: 4.2CC: aschoen, ceph-eng-bugs, gabrioux, gmeno, mmuench, nthomas, roemerso, tserlin, vereddy, ykaul
Target Milestone: ---   
Target Release: 4.3z1   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: ceph-ansible-4.0.70.4-1.el8cp, ceph-ansible-4.0.70.4-1.el7cp Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-09-22 11:21:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Teoman ONAY 2021-11-26 15:50:20 UTC 
Description of problem:

When a mon or rgw container starts, it changes the selinux context from the folder /etc/pki/ca-trust/extracted from 
system_u: object_r: cert_t: -> system_u: object_r: container_file_t: 

Because of that change, the sssd daemon (and other processes requiring access to that folder) running on the host can no longer get access the files in that folder.

Version-Release number of selected component (if applicable):
Ceph 4

How reproducible:
Just install Ceph 4 and start the mon container. The selinux of /etc/pki/ca-trust/extracted will change to system_u: object_r: container_file_t

Steps to Reproduce:
1.
2.
3.

Actual results:
See Description

Expected results:
/etc/pki/ca-trust/extracted selinux context should remain system_u: object_r: cert_t

Additional info:

When starting the container we use:

-v /etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:z

we use z instead of ro. Should be:

-v /etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro

Looks like the changes comes from the following commits:

for ceph-mon.service.j2:

https://github.com/ceph/ceph-ansible/commit/2b0616ecca1f526dd669d00b7b5f501affebb6ca

for ceph-radosgw.service.j2:

This was correct (ro)
https://github.com/ceph/ceph-ansible/commit/0c1944236bfb397e9dff6ef436569556bc00379d#diff-8ea42d4e4e57f87e292489cbb56d96dfd29c407c4488c5b19cc85ce95c5e973cR21

but here it has been changed to z
https://github.com/ceph/ceph-ansible/commit/0bee90b20195f0764c3d9001fb06d0999b5fc6cf#diff-8ea42d4e4e57f87e292489cbb56d96dfd29c407c4488c5b19cc85ce95c5e973cR30
Comment 1 Teoman ONAY 2022-01-27 10:16:18 UTC 
PR upstream proposed to fix this:

ceph-ansible: https://github.com/ceph/ceph-ansible/pull/7061
ceph: https://github.com/ceph/ceph/pull/44802
Comment 2 Teoman ONAY 2022-03-07 13:56:50 UTC 
New PR: https://github.com/ceph/ceph-ansible/pull/7109
Comment 7 Ameena Suhani S H 2022-05-18 20:48:36 UTC 
Verified using 
ceph-ansible-4.0.70.4-1.el8cp.noarch
ansible-2.9.27-1.el8ae.noarch
ceph version 14.2.22-113.el8cp
Comment 11 errata-xmlrpc 2022-09-22 11:21:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat Ceph Storage 4.3 Bug Fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:6684