Bug 674316 - SELinux prevents tape load with amrestore
SELinux prevents tape load with amrestore
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: amanda (Show other bugs)
6.0
x86_64 Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Josef Ridky
qe-baseos-daemons
: SELinux
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-02-01 07:51 EST by Mike Leech
Modified: 2017-09-25 04:47 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-09-25 04:26:03 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
jridky: needinfo-


Attachments (Terms of Use)
sealert results (2.39 KB, text/plain)
2011-02-01 07:53 EST, Mike Leech
no flags Details
amidxtaped debug file (2.72 KB, application/octet-stream)
2011-02-01 08:03 EST, Mike Leech
no flags Details

  None (edit)
Description Mike Leech 2011-02-01 07:51:41 EST
Description of problem:
On running amrestore with selinux enabled, amrestore is unable to find the tape. Here is the output: 

Load tape DailySet1-002 now
Continue [?/Y/n/s/d]? y
Volume labeled 'DailySet1-002' not found.
Load tape DailySet1-002 now
Continue [?/Y/n/d]? n
Got no header and data from server, check in amidxtaped.*.debug and amandad.*.debug files on server
amrecover> quit

After setenforce 0, all works fine.

Output of sealert on audit message is attached.

Note: I am using virtual tapes on disk. I had to change the file context on the virtual tape directory to amanda_data_t to even get this far. Also, I am running amrestore localy on the backup server.

Version-Release number of selected component (if applicable):
amanda 2.6.1p2-7.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Use amanda to backup to virtual tapes.
2. Try to recover with amrestore and selinux enabled
3.
  
Actual results:
Doesn't find tape.

Expected results:
Finds tape and restores.
Comment 1 Mike Leech 2011-02-01 07:53:09 EST
Created attachment 476389 [details]
sealert results
Comment 3 Mike Leech 2011-02-01 08:03:31 EST
Created attachment 476392 [details]
amidxtaped debug file
Comment 4 RHEL Product and Program Management 2011-02-01 11:48:44 EST
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.
Comment 5 Lukáš Nykrýn 2011-08-09 09:01:14 EDT
Adding selinux-policy maintainer to CC.
Comment 7 Miroslav Grepl 2016-12-05 11:09:14 EST
Is it still issue? Did you need to switch to permissive mode to make it working? It is caused by "ps".
Comment 8 Josef Ridky 2017-09-25 04:26:03 EDT
Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the
Production 3 Phase, Critical impact Security Advisories (RHSAs) and
selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as
they become available.

The official life cycle policy can be reviewed here:

http://redhat.com/rhel/lifecycle

This issue does not meet the inclusion criteria for the Production 3 Phase
and will be marked as CLOSED/WONTFIX. If this remains a critical
requirement, please contact Red Hat Customer Support to request
a re-evaluation of the issue, citing a clear business justification. Note
that a strong business justification will be required for re-evaluation.
Red Hat Customer Support can be contacted via the Red Hat Customer Portal
at the following URL:

https://access.redhat.com/

Note You need to log in before you can comment on or make changes to this bug.