Bug 667703 - selinux policy for corosync fails to allow it to read config
Summary: selinux policy for corosync fails to allow it to read config
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-06 15:08 UTC by Steve Whitehouse
Modified: 2011-01-06 19:21 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-01-06 19:21:16 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
ausearch -m avc -ts today >my.avc (45.46 KB, text/plain)
2011-01-06 15:28 UTC, Steve Whitehouse
no flags Details

Description Steve Whitehouse 2011-01-06 15:08:05 UTC
Take one newly installed f14 via beaker provisioning, add gfs2-utils, gfs2-cluster and the deps. Turn off NetworkManager, turn on network. Create /etc/cluster/cluster.conf, do /etc/init.d/cman start, and I get this:

[root@gfs-a24c-01 ~]# /etc/init.d/cman start
Starting cluster: 
   Checking Network Manager... [  OK  ]
   Global setup... [  OK  ]
   Loading kernel modules... [  107.997256] DLM (built Oct 18 2010 23:59:12) ind
[  OK  ]
   Mounting configfs... [  OK  ]
   Starting cman... I/O warning : failed to load external entity "/etc/cluster/"

Unable to get the configuration
I/O warning : failed to load external entity "/etc/cluster/cluster.conf"
corosync [MAIN  ] Corosync Cluster Engine ('1.3.0'): started and ready to provi.
corosync [MAIN  ] Corosync built-in features: nss rdma
corosync [MAIN  ] Unable to read config from /etc/cluster/cluster.conf
corosync [MAIN  ] Corosync Cluster Engine exiting with status 8 at main.c:1626.
corosync died: Could not read cluster configuration Check cluster logs for detas
[FAILED]

Turn selinux into permissive mode and it appears to work correctly.

Comment 1 Miroslav Grepl 2011-01-06 15:15:39 UTC
What AVC messages are you seeing?

# ausearch -m avc -ts today 


Also how is "/etc/cluster/cluster.conf" labeled?

# ls -Z /etc/cluster/cluster.conf

Comment 2 Steve Whitehouse 2011-01-06 15:25:59 UTC
[root@gfs-a24c-01 ~]# ls -Z /etc/cluster/cluster.conf
-rw-r-----. root root unconfined_u:object_r:admin_home_t:s0 /etc/cluster/cluster.conf

Comment 3 Steve Whitehouse 2011-01-06 15:28:03 UTC
Created attachment 472079 [details]
ausearch -m avc -ts today >my.avc

Comment 4 Daniel Walsh 2011-01-06 19:21:16 UTC
Steve you created the file in /root and then moved it to /etc/cluster/cluster.conf

This means it maintained the label of admin_home_t which corosync would not be allowed to read.

Run restorecon -R -v /etc/cluster

Will fix the problem.


Note You need to log in before you can comment on or make changes to this bug.