Bug 504606 - cluster won't start with SELinux enforcing - aisexec sem/shm denials
cluster won't start with SELinux enforcing - aisexec sem/shm denials
Status: CLOSED DUPLICATE of bug 271561
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: cluster (Show other bugs)
6.0
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: Christine Caulfield
GFS Bugs
:
Depends On: 498139 503141 522159
Blocks:
  Show dependency treegraph
 
Reported: 2009-06-08 09:46 EDT by Perry Myers
Modified: 2016-04-26 11:20 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 503141
Environment:
Last Closed: 2009-09-30 18:07:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Perry Myers 2009-06-08 09:46:31 EDT
+++ This bug was initially created as a clone of Bug #503141 +++

Created an attachment (id=345866)
denial messages from auditd

Description of problem:
Hosts running RHEL 5.3 with SELinux enforcing will not be able to create a RHCS cluster.

Upon cluster start (service cman start), aisexec attempts to allocate some shared memory segments / semaphores, which is denied by the default RHEL 5.3 targeted SELinux policy. Whilst the cluster is technically quorate at this point, it results in the cluster startup hanging indefinitely at "Starting fencing..." where fenced is, I assume, trying to communicate with aisexec via the non-existant shared memory realm.

This also causes "cman_tool services" to hang, also unable to communicate with aisexec.



Version-Release number of selected component (if applicable):

openais-0.80.3-22.el5_3.4
cman-2.0.98-1.el5_3.1
selinux-policy-targeted-2.4.6-203.el5
selinux-policy-2.4.6-203.el5


How reproducible:
Every time.

Steps to Reproduce:
1. Install rhel5.3 with selinux enforcing
2. Configure RHCS cluster
3. Attempt to start it
  
Actual results:
Cluster unusable, as described above. Auditd reports denials in audit.log (attached).



Expected results:
Cluster starts normally.


Additional info:

I assume a simple policy update to include:
    allow ccs_t initrc_t:sem { unix_read unix_write };
    allow ccs_t initrc_t:shm { unix_read unix_write };
or similar will fix this.

--- Additional comment from ccaulfie@redhat.com on 2009-06-04 09:23:29 EDT ---

I strongly suspect that SElinux in enforcing mode will also generate plenty of other errors too, even if those two are fixed.

There is an open project to make Cluster Suite work nicely with SElinux, though I can't locate a bugzilla off-hand.

--- Additional comment from tom@netspot.com.au on 2009-06-04 19:12:37 EDT ---

Should it at least be documented, then, that Cluster Suite is not supported with SELinux enforcing?

None of the RHCS documentation even mentions SELinux let alone that it will not work.

--- Additional comment from pmyers@redhat.com on 2009-06-08 09:44:16 EDT ---

(In reply to comment #1)
> There is an open project to make Cluster Suite work nicely with SElinux, though
> I can't locate a bugzilla off-hand.  

As of now, this is the bugzilla for tracking selinux support for cluster-suite in RHEL5.  Will clone for RHEL6 as well.
Comment 1 RHEL Product and Program Management 2009-06-08 10:06:10 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 2 Christine Caulfield 2009-07-30 04:17:36 EDT
A policy has been submitted for inclusion in Fedora12
Comment 3 Perry Myers 2009-09-30 18:07:53 EDT
The correct component for this fix is selinux-policy and given that there is an existing bug in RHEL6 for this I'm closing this as a duplicate of that.

*** This bug has been marked as a duplicate of bug 271561 ***

Note You need to log in before you can comment on or make changes to this bug.