Bug 504606

+++ This bug was initially created as a clone of Bug #503141 +++

Created an attachment (id=345866)
denial messages from auditd

Description of problem:
Hosts running RHEL 5.3 with SELinux enforcing will not be able to create a RHCS cluster.

Upon cluster start (service cman start), aisexec attempts to allocate some shared memory segments / semaphores, which is denied by the default RHEL 5.3 targeted SELinux policy. Whilst the cluster is technically quorate at this point, it results in the cluster startup hanging indefinitely at "Starting fencing..." where fenced is, I assume, trying to communicate with aisexec via the non-existant shared memory realm.

This also causes "cman_tool services" to hang, also unable to communicate with aisexec.



Version-Release number of selected component (if applicable):

openais-0.80.3-22.el5_3.4
cman-2.0.98-1.el5_3.1
selinux-policy-targeted-2.4.6-203.el5
selinux-policy-2.4.6-203.el5


How reproducible:
Every time.

Steps to Reproduce:
1. Install rhel5.3 with selinux enforcing
2. Configure RHCS cluster
3. Attempt to start it
  
Actual results:
Cluster unusable, as described above. Auditd reports denials in audit.log (attached).



Expected results:
Cluster starts normally.


Additional info:

I assume a simple policy update to include:
    allow ccs_t initrc_t:sem { unix_read unix_write };
    allow ccs_t initrc_t:shm { unix_read unix_write };
or similar will fix this.

--- Additional comment from ccaulfie on 2009-06-04 09:23:29 EDT ---

I strongly suspect that SElinux in enforcing mode will also generate plenty of other errors too, even if those two are fixed.

There is an open project to make Cluster Suite work nicely with SElinux, though I can't locate a bugzilla off-hand.

--- Additional comment from tom.au on 2009-06-04 19:12:37 EDT ---

Should it at least be documented, then, that Cluster Suite is not supported with SELinux enforcing?

None of the RHCS documentation even mentions SELinux let alone that it will not work.

--- Additional comment from pmyers on 2009-06-08 09:44:16 EDT ---

(In reply to comment #1)
> There is an open project to make Cluster Suite work nicely with SElinux, though
> I can't locate a bugzilla off-hand.  

As of now, this is the bugzilla for tracking selinux support for cluster-suite in RHEL5.  Will clone for RHEL6 as well.