Bug 588680 - openais-cfgtool hangs in RHEL 5.5 when SELinux is enabled
openais-cfgtool hangs in RHEL 5.5 when SELinux is enabled
Status: CLOSED CANTFIX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.5
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-04 05:30 EDT by Tomas Smetana
Modified: 2010-11-23 11:41 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-23 11:41:49 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
The AVC messages (11.14 KB, text/plain)
2010-05-04 05:31 EDT, Tomas Smetana
no flags Details
The AVC messages after re-label and restarting the services (3.61 KB, text/plain)
2010-05-13 06:45 EDT, Tomas Smetana
no flags Details

  None (edit)
Description Tomas Smetana 2010-05-04 05:30:18 EDT
Description of problem:
The command "openais-cfgtool -s" hangs after the message "Printing ring status." on an system with SELinux set to enforcing.

Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-279.el5
selinux-policy-targeted-2.4.6-279.el5

How reproducible:
Always

Steps to Reproduce:
1. openais-cfgtool -s
  
Actual results:
openais-cfgtool hangs and AVC messages appear in the audit log

Expected results:
no hang, no AVC messages

Additional info:
Comment 1 Tomas Smetana 2010-05-04 05:31:10 EDT
Created attachment 411232 [details]
The AVC messages
Comment 2 Daniel Walsh 2010-05-04 13:39:21 EDT
Miroslav

Add

userdom_rw_semaphores(aisexec_t)
userdom_rw_unpriv_user_shared_mem(aisexec_t)

Tomas, what process is running as initrc_t?

ps -eZ | grep initrc_t
Comment 3 Tomas Smetana 2010-05-10 04:25:40 EDT
(In reply to comment #2)

[root@server1 ~]# ps -eZ | grep initrc_t
system_u:system_r:initrc_t       5972 ?        00:00:27 qdiskd
system_u:system_r:initrc_t       5981 ?        00:00:00 groupd
system_u:system_r:initrc_t       5988 ?        00:00:00 fenced
system_u:system_r:initrc_t       5994 ?        00:00:00 dlm_controld
system_u:system_r:initrc_t       6000 ?        00:00:00 gfs_controld
system_u:system_r:initrc_t       6343 ?        00:00:00 osad
system_u:system_r:initrc_t       6566 ?        00:00:00 hpasmlited
system_u:system_r:initrc_t       6628 ?        00:00:00 rhnsd
system_u:system_r:initrc_t       6982 ?        00:00:00 clurgmgrd
system_u:system_r:initrc_t       6983 ?        00:02:45 clurgmgrd
Comment 4 Miroslav Grepl 2010-05-11 09:50:29 EDT
Tomas,
could you try to run 

# restorecon -R -v /usr/sbin/

and then restart these services. Cluster services shouldn't be running in the initrc domain.
Comment 5 Tomas Smetana 2010-05-13 06:44:53 EDT
Hello,
  yes, there were some mis-labelled binaries there:

[root@server1 ~]# restorecon -Rv /usr/sbin
restorecon reset /usr/sbin/clubufflush context system_u:object_r:sbin_t:s0->system_u:object_r:fsadm_exec_t:s0
restorecon reset /usr/sbin/clurgmgrd context system_u:object_r:sbin_t:s0->system_u:object_r:rgmanager_exec_t:s0
restorecon reset /usr/sbin/qdiskd context system_u:object_r:sbin_t:s0->system_u:object_r:qdiskd_exec_t:s0 

However the restart of the services resulted in the same AVC messages in the logs.
Comment 6 Tomas Smetana 2010-05-13 06:45:48 EDT
Created attachment 413710 [details]
The AVC messages after re-label and restarting the services
Comment 7 Miroslav Grepl 2010-05-21 09:25:36 EDT
Ok,

what process is running as initrc_t now?

ps -eZ | grep initrc_t
Comment 8 Tomas Smetana 2010-05-26 08:04:25 EDT
# ps -eZ | grep initrc_t
system_u:system_r:initrc_t       5943 ?        00:00:00 groupd
system_u:system_r:initrc_t       5950 ?        00:00:00 fenced
system_u:system_r:initrc_t       5956 ?        00:00:00 dlm_controld
system_u:system_r:initrc_t       5962 ?        00:00:00 gfs_controld
system_u:system_r:initrc_t       6306 ?        00:00:01 osad
system_u:system_r:initrc_t       6498 ?        00:00:00 hpasmlited
system_u:system_r:initrc_t       6560 ?        00:00:00 rhnsd

Note You need to log in before you can comment on or make changes to this bug.