Description of problem: The command "openais-cfgtool -s" hangs after the message "Printing ring status." on an system with SELinux set to enforcing. Version-Release number of selected component (if applicable): selinux-policy-2.4.6-279.el5 selinux-policy-targeted-2.4.6-279.el5 How reproducible: Always Steps to Reproduce: 1. openais-cfgtool -s Actual results: openais-cfgtool hangs and AVC messages appear in the audit log Expected results: no hang, no AVC messages Additional info:
Created attachment 411232 [details] The AVC messages
Miroslav Add userdom_rw_semaphores(aisexec_t) userdom_rw_unpriv_user_shared_mem(aisexec_t) Tomas, what process is running as initrc_t? ps -eZ | grep initrc_t
(In reply to comment #2) [root@server1 ~]# ps -eZ | grep initrc_t system_u:system_r:initrc_t 5972 ? 00:00:27 qdiskd system_u:system_r:initrc_t 5981 ? 00:00:00 groupd system_u:system_r:initrc_t 5988 ? 00:00:00 fenced system_u:system_r:initrc_t 5994 ? 00:00:00 dlm_controld system_u:system_r:initrc_t 6000 ? 00:00:00 gfs_controld system_u:system_r:initrc_t 6343 ? 00:00:00 osad system_u:system_r:initrc_t 6566 ? 00:00:00 hpasmlited system_u:system_r:initrc_t 6628 ? 00:00:00 rhnsd system_u:system_r:initrc_t 6982 ? 00:00:00 clurgmgrd system_u:system_r:initrc_t 6983 ? 00:02:45 clurgmgrd
Tomas, could you try to run # restorecon -R -v /usr/sbin/ and then restart these services. Cluster services shouldn't be running in the initrc domain.
Hello, yes, there were some mis-labelled binaries there: [root@server1 ~]# restorecon -Rv /usr/sbin restorecon reset /usr/sbin/clubufflush context system_u:object_r:sbin_t:s0->system_u:object_r:fsadm_exec_t:s0 restorecon reset /usr/sbin/clurgmgrd context system_u:object_r:sbin_t:s0->system_u:object_r:rgmanager_exec_t:s0 restorecon reset /usr/sbin/qdiskd context system_u:object_r:sbin_t:s0->system_u:object_r:qdiskd_exec_t:s0 However the restart of the services resulted in the same AVC messages in the logs.
Created attachment 413710 [details] The AVC messages after re-label and restarting the services
Ok, what process is running as initrc_t now? ps -eZ | grep initrc_t
# ps -eZ | grep initrc_t system_u:system_r:initrc_t 5943 ? 00:00:00 groupd system_u:system_r:initrc_t 5950 ? 00:00:00 fenced system_u:system_r:initrc_t 5956 ? 00:00:00 dlm_controld system_u:system_r:initrc_t 5962 ? 00:00:00 gfs_controld system_u:system_r:initrc_t 6306 ? 00:00:01 osad system_u:system_r:initrc_t 6498 ? 00:00:00 hpasmlited system_u:system_r:initrc_t 6560 ? 00:00:00 rhnsd